Agree a backup policy

[iaindillingham]

We should agree, and write, a backup policy. Currently, the nature and frequency of backups are implementation details (#2116). The policy should describe how much data we're prepared to lose, should restoring from a backup be necessary.

[lucyb]

I think we've decided to split the policy into:

1. the core application database
2. the coding systems databases

We can document our approach to 1. as part of doing the work in #2151. I've suggested we keep it at the current 30 days of backup, but that we move the backups to a separate folder (we can build on this in future).

I think the coding systems databases are less urgent, because we have the droplet snapshots that we can fallback on, and any policy can be documented when we pick up #2153.

Does this seem reasonable?