Add VM-side backup retention (was completely unbounded)

Checking disk usage on the VM (95% full, blocking the planned k3s
install) found /backups/cloudproject had 85 legacy Docker-era
myapps-backup-* archives totaling 131GB, dating back to May — the whole
tier had never had any retention at all, only local (TIER 1) and R2
(TIER 3) did. Those 85 are from before the k8s migration entirely (the
Docker volumes they captured don't exist anymore), so deleted all of
them directly on the VM rather than just trimming a few.

Added retention to the VM upload step mirroring the existing local
policy exactly: same MAX_BACKUPS, own myapps-k8s-backup-* glob only —
never touches the other unrelated backup directories that also live on
this VM (imcbackups/mpack/garage, other servers' backups, already
separately reviewed and left alone except a manual one-off trim of
garage's uncapped 31-day history down to 10).

Disk usage: 183G/193G (95%) -> 50G/193G (26%) after cleanup.

backup/backup-k8s-apps.sh

@@ -482,6 +482,16 @@ if [ $VM_SCP_RC -eq 0 ]; then
         "${BACKUP_NAME}.tar.gz.sha256" \
         "${VM_USER}@${VM_HOST}:${VM_DEST}" 2>/dev/null || true
     TIER2_STATUS="ok"
+
+    # VM-side retention — this tier never had any pruning at all until
+    # found accumulating 85 legacy pre-k8s archives (131GB) untouched
+    # since May. Mirrors the local [TIER 1] policy above: same
+    # MAX_BACKUPS, own glob/lineage only (never touches other
+    # unrelated backup dirs also living on this VM).
+    ssh -i "$VM_KEY" -p "$VM_PORT" -o StrictHostKeyChecking=no -o ConnectTimeout=15 \
+        "${VM_USER}@${VM_HOST}" \
+        "cd ${VM_DEST} && ls -t myapps-k8s-backup-*.tar.gz 2>/dev/null | tail -n +$((MAX_BACKUPS + 1)) | xargs -r -I{} rm -f {} {}.sha256 {}.meta.json" \
+        &>/dev/null || true
 else
     echo "   ⚠️  VM transfer failed (rc=$VM_SCP_RC) — local backup is safe, continuing..."
     TIER2_STATUS="failed:rc=${VM_SCP_RC}"