feat: use host bind mounts for persistent data

docs/operations.md

@@ -6,6 +6,7 @@
 docker compose up --build -d
 docker compose ps
 docker compose logs -f proxy wordpress db certbot
+./scripts/prepare-host-volumes.sh
 docker compose --profile tools run --rm wp-cli -c 'wp core version'
 docker compose down
 ```
@@ -24,9 +25,11 @@ image rebuilds are the update path.
 
 ## Backup and restore
 
-Create database and `wordpress_data` backups in one maintenance window. Backups contain
-credentials, accounts, contact information, and uploaded media; encrypt them, restrict
-access, set retention, and store copies off-host.
+Create database and WordPress file backups in one maintenance window. The default host
+paths are `./runtime/db`, `./runtime/wordpress`, `./runtime/letsencrypt`, and
+`./runtime/certbot/www`, unless overridden in `.env`. Backups contain credentials,
+accounts, contact information, and uploaded media; encrypt them, restrict access, set
+retention, and store copies off-host.
 
 A restore is destructive. Validate it on isolated volumes, then stop WordPress, restore
 the database and file volume together, restart, and verify the homepage, media,
@@ -34,7 +37,10 @@ the database and file volume together, restart, and verify the homepage, media,
 
 ## Known risks
 
-- Local named volumes are not backups.
+- Local host directories are not backups.
+- A host-based volume may be unreadable by the application if created with the wrong
+  owner or mode; run `./scripts/prepare-host-volumes.sh` after changing paths or image
+  user IDs.
 - SMTP is not configured; WordPress password-reset email needs an external mail service.
 - Admin MFA and network allowlisting are deployment concerns and are not bundled.
 - WordPress plugins expand the attack surface; install only reviewed, maintained,