rename(547): the server is grimoire — package, image, DB defaults, backups

Step 2 of the Scribe -> Grimoire rename.

- src/scribe -> src/grimoire, and every import, patch target, module path,
  hypercorn entry point and `python -m grimoire.restore` with it; pyproject,
  uv.lock and the frontend package are named grimoire.
- Image git.fabledsword.com/bvandeusen/fabledgrimoire; CI's Postgres service
  runs as grimoire / grimoire_test.
- Compose files default the DB user, database and (prod) volume to grimoire,
  each overridable from .env, so an install created as Scribe keeps its data
  by setting POSTGRES_USER, POSTGRES_DB and PGDATA_VOLUME.
- Backups are written as grimoire-<ts>.tar with format grimoire-backup-tar.
  Archives named scribe-* with the scribe-backup-tar manifest still restore
  and are still counted at the destination (folder and S3), with tests.
- Exports, the MCP auth realm, the ASGI scope key and the persistent logger
  carry the new name.

Kept on purpose: the secret-sealing key label stays "scribe.secrets.v1",
because every stored secret was derived under it.

Plugin identity (plugin name, hooks, env vars, .scribe marker, skills) is
step 3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/backups.md

@@ -11,9 +11,12 @@ Set it up under **Settings → Data → Scheduled backups** (admins only).
 One file per run, named for the moment it was taken in UTC:
 
 ```
-scribe-20261015T020000Z.tar
+grimoire-20261015T020000Z.tar
 ```
 
+Backups written while the app was called Scribe are named `scribe-…tar`.
+They are counted with the rest and restore the same way.
+
 It is a plain, **uncompressed** tar:
 
 - `manifest.json` comes first. It holds the backup format version, the Grimoire
@@ -65,12 +68,12 @@ A path **inside the Grimoire container**, normally a share mounted there:
 
 ```yaml
 services:
-  scribe:
+  grimoire:
     volumes:
-      - /nfs/backup/scribe:/backups
+      - /nfs/backup/grimoire:/backups
 ```
 
-Grimoire writes each file under a hidden name (`.scribe-….tar.part`) and renames
+Grimoire writes each file under a hidden name (`.grimoire-….tar.part`) and renames
 it once it is complete. A program watching the folder never sees half a
 backup.
 
@@ -115,7 +118,7 @@ page asks for the secret again.
 [Fabled Archives](https://git.fabledsword.com/bvandeusen/fabledarchives)
 keeps service backups as "backup targets". Either destination works with it.
 
-1. On Archives' **Backups** page, make a target for Grimoire, named `scribe`
+1. On Archives' **Backups** page, make a target for Grimoire, named `grimoire`
    for example.
 2. Choose how Grimoire's files arrive:
    - **S3**: turn on the S3 way in for the target and make an **append-only**
@@ -124,8 +127,8 @@ keeps service backups as "backup targets". Either destination works with it.
      - bucket: the target's name;
      - access key and secret key: the key you just made.
    - **A folder**: mount the share Archives watches into Grimoire as
-     `/backups/scribe`, and point the target at that folder. In Grimoire, choose
-     **A folder** with `/backups/scribe`.
+     `/backups/grimoire`, and point the target at that folder. In Grimoire, choose
+     **A folder** with `/backups/grimoire`.
 3. Set the target's **Retention** to **Archives**. Archives then keeps the
    newest backups and thins the rest by day, week and month. Grimoire only adds.
 4. Give the target an expected cadence of **daily**, so a missed backup turns
@@ -141,7 +144,7 @@ Start Grimoire on an empty database, copy the backup file into the container,
 and run:
 
 ```sh
-docker exec -it scribe python -m scribe.restore /backups/scribe-20261015T020000Z.tar
+docker exec -it grimoire python -m grimoire.restore /backups/grimoire-20261015T020000Z.tar
 ```
 
 - The command refuses a database that already has an account. A restore