chore(obs): improve deploy maintainability from review feedback

- Move POSTGRES_USER to obs.env (non-secret, constant across envs)
- Replace cp -r with rsync -a --delete so removed config files are
  purged from /opt/familienarchiv on next deploy instead of lingering
- Document --env-file ordering contract in validate + start steps:
  obs.env first (defaults), obs-secrets.env second (wins on dupes)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

infra/observability/obs.env

@@ -14,6 +14,8 @@ PORT_PROMETHEUS=9090
 GF_SERVER_ROOT_URL=https://grafana.archiv.raddatz.cloud
 GLITCHTIP_DOMAIN=https://glitchtip.archiv.raddatz.cloud
 
+POSTGRES_USER=archiv
+
 # PostgreSQL hostname for GlitchTip db-init and workers.
 # The actual value depends on the Compose project name — it is not a fixed string.
 # CI sets POSTGRES_HOST in obs-secrets.env per environment: