docs: firmware rollouts and backups

Neither area had a page, and both changed materially in v0.24.2/v0.24.3.

The firmware page records why the pipeline downloads and verifies before
rebooting, and what raising "at once" actually costs: halting becomes less
precise, devices reboot together, and the upstream warning is conservative
enough that its absence is not proof of safety.

The backups page leads with the fact that a backup is /export text rather
than a binary blob, since that is what makes preview and diff possible and
what limits what a restore can do. It also states plainly that a backup and
its Config History snapshot are one artifact, so deleting one removes the
other's rollback.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/README.md

@@ -14,6 +14,8 @@ whether to try it, the [project README](https://github.com/2GT-Media-Group-LLC/m
 | [Cellular (LTE)](cellular.md) | Signal, carriers, tower movement, and the data-cap reset SMS |
 | [SSH keys](ssh-keys.md) | Per-device keypairs, rotation, and what installing one costs |
 | [Bulk commands](commands.md) | Running one command across a fleet, in waves |
+| [Firmware rollouts](firmware.md) | Waves, the upgrade pipeline, and what upgrading several at once costs |
+| [Backups](backups.md) | Finding, reading, comparing and deleting configuration backups |
 | [Polling and scaling](scaling.md) | Poller health, headroom, tuning, and clearing a backlog |
 | [API and automation](api.md) | Scoped tokens, authentication, and driving the platform from scripts |
 | [Architecture](architecture.md) | How the system is put together, for contributors |