lubelogger+homepage: dedicated PBS tokens

- backup job -> dedicated root@pam!lubelogger-backup token (DatastoreBackup);
  prune made non-fatal pending a group-scoped PBS prune-job (Datastore.Prune deferred).
- Homepage PBS widget -> homepage@pbs!widget (Datastore.Audit); Proxmox Beast
  (root@pam!homepage) left intact, deferred. Secrets in vault/.env only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

lubelogger/deploy-lubelogger.yml

@@ -123,7 +123,7 @@
           # Managed by deploy-lubelogger.yml. PBS push creds — NOT in git.
           PBS_PASSWORD={{ vault_lubelogger_pbs_token }}
           PBS_FINGERPRINT=90:6B:3E:85:C4:E7:77:F0:24:25:1D:B0:2C:F9:6D:08:AA:CE:08:CE:7B:04:4C:C7:C9:E0:CF:DD:99:44:DB:21
-          PBS_REPOSITORY='root@pam!vaultwarden-backup@192.168.99.153:rust-usb'
+          PBS_REPOSITORY='root@pam!lubelogger-backup@192.168.99.153:rust-usb'
       no_log: true
 
     - name: Install lubelogger backup script
@@ -159,9 +159,13 @@
             --backup-type host \
             --backup-id lubelogger
 
+          # Retention: token holds Datastore.Backup only (Prune deferred to a PBS
+          # group-scoped prune-job). Keep this non-fatal so nightly backups still
+          # succeed; it starts pruning automatically if Datastore.Prune is granted.
           proxmox-backup-client prune "host/lubelogger" \
             --repository "$PBS_REPOSITORY" \
-            --keep-daily 14
+            --keep-daily 14 \
+            || echo "NOTE: prune skipped (Datastore.Prune not granted; retention via deferred PBS prune-job)"
       notify: reload systemd
 
     - name: Install backup systemd service unit