docs: firmware rollouts and backups

Neither area had a page, and both changed materially in v0.24.2/v0.24.3.

The firmware page records why the pipeline downloads and verifies before
rebooting, and what raising "at once" actually costs: halting becomes less
precise, devices reboot together, and the upstream warning is conservative
enough that its absence is not proof of safety.

The backups page leads with the fact that a backup is /export text rather
than a binary blob, since that is what makes preview and diff possible and
what limits what a restore can do. It also states plainly that a backup and
its Config History snapshot are one artifact, so deleting one removes the
other's rollback.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -370,6 +370,8 @@ so it moves when behaviour does.
 | [Configuration](docs/configuration.md) | Environment variables, secret management, key rotation, TLS |
 | [Change Guard and Config Health](docs/change-guard.md) | How the safety system works, its settings, and what to expect when it fires |
 | [Sites](docs/sites.md) | Grouping devices into sites, switching between them, and what each site scopes |
+| [Firmware rollouts](docs/firmware.md) | Waves, the upgrade pipeline, and what upgrading several at once costs |
+| [Backups](docs/backups.md) | Finding, reading, comparing and deleting configuration backups |
 | [Alerting](docs/alerting.md) | Rules, channels, ntfy priority mapping, webhooks, maintenance windows |
 | [Single sign-on (OIDC)](docs/sso-oidc.md) | Identity provider setup, group-to-role mapping, break-glass behaviour |
 | [CAPsMAN](docs/capsman.md) | How centrally provisioned APs are modelled, and current limits |