Backup pipeline (CI): runs pg_dump via Ansible on the old DB server, uploads dump to s3://migration/ bucket in RustFS. No extra secrets needed. Restore script (workstation): downloads from S3, copies into K8s CNPG pod, runs pg_restore. Uses local kubectl and aws-cli. Preserves all users, passwords, 2FA, WebAuthn, and sessions. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>