Document TimescaleDB in README and AGENTS

AGENTS.md

@@ -217,6 +217,37 @@ k3s kubectl exec -n gitea deploy/gitea -- gitea admin user generate-access-token
 - HOSTNAME=0.0.0.0
 - NODE_ENV=production
 
+### TimescaleDB
+
+| Property | Value |
+|---|---|
+| Namespace | system |
+| Image | timescale/timescaledb:2.29.1-pg16 |
+| Workload | StatefulSet (1 replica) |
+| Pod | timescaledb-0 |
+| Service | timescaledb.system.svc.cluster.local:5432 |
+| Storage | 10 Gi Longhorn PVC `timescaledb-data` |
+| Auth | None (POSTGRES_HOST_AUTH_METHOD=trust) |
+| PGDATA | /var/lib/postgresql/data/pgdata (subdir to avoid lost+found) |
+| Extension | timescaledb v2.29.1 (auto-enabled on all databases) |
+
+**Connect from inside the cluster:**
+```bash
+# From any pod:
+psql -h timescaledb.system.svc.cluster.local -U postgres
+
+# Via kubectl:
+k3s kubectl exec -n system timescaledb-0 -- psql -U postgres
+```
+
+**Create a database with TimescaleDB:**
+```bash
+k3s kubectl exec -n system timescaledb-0 -- psql -U postgres -c "CREATE DATABASE mydb;"
+k3s kubectl exec -n system timescaledb-0 -- psql -U postgres -d mydb -c "CREATE EXTENSION IF NOT EXISTS timescaledb;"
+```
+
+**No auth warning:** This instance has no password — it's designed for internal cluster use only (no ingress, no NodePort, ClusterIP only). Don't expose it externally.
+
 ## Image Pull Secrets
 
 All namespaces pulling from Gitea registry use secret `gitea-registry`:
@@ -324,3 +355,16 @@ docker push gitea.imcu.ro/homeschool/<image>:<new-tag>
 # Update deployment
 k3s kubectl set image deploy/<name> <container>=gitea.imcu.ro/homeschool/<image>:<new-tag> -n <namespace>
 ```
+
+### Back up TimescaleDB
+
+```bash
+# Dump a database
+k3s kubectl exec -n system timescaledb-0 -- pg_dump -U postgres mydb > mydb-backup.sql
+
+# Dump all databases
+k3s kubectl exec -n system timescaledb-0 -- pg_dumpall -U postgres > all-backup.sql
+
+# Restore
+cat mydb-backup.sql | k3s kubectl exec -i -n system timescaledb-0 -- psql -U postgres -d mydb
+```