Backup strategy is documented

The most common backup failure mode is not a missing backup — it is discovering that backups exist but no one knows where they are, how long they are retained, or how to use them during an incident at 2 AM. ISO 25010 recoverability requires a defined, documented, and actionable recovery procedure, not just an assumption that the cloud provider is doing something. Managed databases like Supabase Free include only basic backups; teams that assume PITR is included on the free tier discover the gap after the incident. A documented backup strategy converts an implicit assumption into an auditable commitment.

Add a Backup Strategy section to DEPLOYMENT.md covering frequency, retention, location, and access procedure. For Supabase, document the plan tier and PITR availability explicitly.

## Database Backup Strategy

**Platform:** Supabase Pro
**Automatic backups:** Daily snapshots, 7-day retention
**PITR:** Available (last 7 days)
**Access:** Supabase dashboard > Settings > Backups

### Manual backup (before major migrations)
```bash
pg_dump $DATABASE_URL > backup_$(date +%Y%m%d_%H%M%S).sql
aws s3 cp backup_*.sql s3://myapp-backups/

Last restore test: [date — update after each test]

Also verify your platform plan actually includes the backup retention you need — Supabase Free provides basic backups only, not PITR. Upgrade to Pro ($25/month) for daily PITR, Team for per-minute PITR.