feat(curator): vendor the application backend as the scenario's tracked source

The curator Python backend (package, tests, systemd units, config templates, scripts) now lives under scenarios/curator/backend and is the single source of truth; the live checkout at the workspace path is a runtime copy. Exported from the app repo's tracked tree via git archive (no history, .pi/venv/caches excluded). 149 unit tests pass from the new location.

profile.toml backend is now repo-relative (scenarios/curator/backend); verify-generated.sh resolves a relative backend against REPO_ROOT. verify-no-secrets ASSIGN heuristic now requires value entropy so vendored kwargs like token=extraction_token no longer false-positive. README documents the backend/ layout and the operator-owned app rollout step.

scenarios/curator/backend/systemd/curator-maintenance.service

@@ -0,0 +1,13 @@
+[Unit]
+Description=Curator database backup and retention
+
+[Service]
+Type=oneshot
+WorkingDirectory=/home/claw/pi-workspaces/curator
+Environment=PYTHONPATH=/home/claw/pi-workspaces/curator
+EnvironmentFile=/home/claw/.config/curator/curator.env
+ExecStart=/usr/bin/python3 -m curator maintain
+UMask=0077
+NoNewPrivileges=true
+PrivateTmp=true
+