rename(547): the server is grimoire — package, image, DB defaults, backups

Step 2 of the Scribe -> Grimoire rename.

- src/scribe -> src/grimoire, and every import, patch target, module path,
  hypercorn entry point and `python -m grimoire.restore` with it; pyproject,
  uv.lock and the frontend package are named grimoire.
- Image git.fabledsword.com/bvandeusen/fabledgrimoire; CI's Postgres service
  runs as grimoire / grimoire_test.
- Compose files default the DB user, database and (prod) volume to grimoire,
  each overridable from .env, so an install created as Scribe keeps its data
  by setting POSTGRES_USER, POSTGRES_DB and PGDATA_VOLUME.
- Backups are written as grimoire-<ts>.tar with format grimoire-backup-tar.
  Archives named scribe-* with the scribe-backup-tar manifest still restore
  and are still counted at the destination (folder and S3), with tests.
- Exports, the MCP auth realm, the ASGI scope key and the persistent logger
  carry the new name.

Kept on purpose: the secret-sealing key label stays "scribe.secrets.v1",
because every stored secret was derived under it.

Plugin identity (plugin name, hooks, env vars, .scribe marker, skills) is
step 3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_settings_defaults_agree.py

@@ -38,7 +38,7 @@ import re
 import pytest
 
 ROOT = pathlib.Path(__file__).resolve().parents[1]
-_SERVICES = ROOT / "src" / "scribe" / "services"
+_SERVICES = ROOT / "src" / "grimoire" / "services"
 _VUE = ROOT / "frontend" / "src" / "views" / "SettingsView.vue"
 
 # THE SIX RETRIEVAL FLOORS live in one registry, so their side of
@@ -104,7 +104,7 @@ def _assert_agrees(server: float, form: float, ref_name: str, what: str) -> None
                          ids=[p[0] for p in _SURFACE_PAIRS])
 def test_the_form_shows_the_floor_the_surface_uses(surface, ref_name):
     """An untouched control must render the bar actually in force."""
-    from scribe.services.retrieval_surfaces import get_surface
+    from grimoire.services.retrieval_surfaces import get_surface
 
     _assert_agrees(get_surface(surface).floor_default, _vue_default(ref_name),
                    ref_name, f"{surface} floor")
@@ -114,7 +114,7 @@ def test_every_tunable_surface_has_a_control():
     """A number an operator may need different has a UI or it is
     not shipped. Derived from the registry, so a seventh surface arrives here
     as a failure rather than as a setting only the model can reach."""
-    from scribe.services.retrieval_surfaces import surface_names
+    from grimoire.services.retrieval_surfaces import surface_names
 
     covered = {s for s, _ref in _SURFACE_PAIRS}
     missing = [n for n in surface_names() if n not in covered]