fix(install): backups exist on a default install; retention resolves real world dirs (#6)

Three faces of one gap, all on the supported install path:

- Backup/restore answered 503 out of the box: nothing ever rendered the
  archive PVC, so FELIS_BACKUP_PVC was unset. The bundle now renders the
  PVC (Minecraft namespace, RWO 10Gi, cluster default class) and
  'felis manifests' names it by default (--backup-pvc= is the explicit
  no-store shape); bootstrap passes it through so the generated felis.toml
  [archive] local_path and the jobs' mount path come from one variable.
- Retention was unreachable: bootstrap never passed the reaper flags. It
  now forwards FELIS_WORLDS_HOST_PATH/FELIS_ARCHIVE_LOCAL_PATH, so one
  env enables the daily CronJob; unset keeps today's fail-safe (no reaper,
  nothing deleted).
- Even when enabled it could not find a world on a stock install:
  resolveWorldDir now also resolves the exact local-path directory
  <pv-name>_<ns>_<pvc-name> read from the live PVC's volumeName (never a
  glob, so a stale deleted PV's bytes can't be archived in place of the
  current world). Reaper Role gains persistentvolumeclaims:get (weaker
  than the delete it already held).

README (zh/en) stops promising automatic/scheduled backups and states
retention is opt-in. bootstrap_test covers the env->flag contract.

internal/platform/rbac.go

@@ -162,6 +162,11 @@ func OperatorRole(p Params) *rbacv1.Role {
 // minecraftservers but cannot create them, and holds no power over StatefulSets,
 // Services, or Secrets — those belong to the operator and api.
 //
+// persistentvolumeclaims also carries get: resolving where a world lives
+// (cmd/felis/reaper.resolveWorldDir) reads the PVC's volumeName to derive the
+// stock local-path directory name. get is strictly weaker than the delete the
+// same rule already grants, so it widens nothing.
+//
 // Note no identity anywhere holds minecraftservers:delete. That is intentional, not
 // a missing grant: reaping releases a server by flipping desiredState=Stopped and
 // reclaiming the world PVC (k8scluster.go does "nothing else"), leaving the CR in
@@ -172,7 +177,7 @@ func ReaperRole(p Params) *rbacv1.Role {
 	p = p.withDefaults()
 	return role(p.MinecraftNamespace, "felis-reaper", ComponentReaper, []rbacv1.PolicyRule{
 		rule([]string{groupFelis}, []string{"minecraftservers"}, []string{"get", "patch"}),
-		rule([]string{groupCore}, []string{"persistentvolumeclaims"}, []string{"delete"}),
+		rule([]string{groupCore}, []string{"persistentvolumeclaims"}, []string{"get", "delete"}),
 	})
 }