terraform: match the servers; open only ports in use

Checked against the Hetzner project:

 - Both servers have daily backups and delete and rebuild protection
   switched on, while the code said backups = false and set no
   protection. An apply would have turned all three off and discarded
   the existing backups. Record them as they are.

 - The firewalls had drifted both ways. Live, asxpio-ops also accepts
   XMPP ports and tcp/5000, and asxpio-services accepts 80, 443, XMPP,
   TURN, Valheim and Factorio ports; none of those services run. The
   code in turn missed tcp/25566, where the second Minecraft server
   listens.

Describe the firewalls as they should be: internal networks, plus the
public ports of services that run. Public SSH to asxpio-services goes
too; sshd and iptables already refuse it from outside the VPN.

This is not applied. The next plan will show the stale ports being
closed and nothing else.

Assisted-by: Claude:fable-5-2

terraform/servers.tf

@@ -10,7 +10,9 @@ resource "hcloud_server" "ops" {
     hcloud_ssh_key.deploy.id
   ]
 
-  backups = false
+  backups            = true
+  delete_protection  = true
+  rebuild_protection = true
 
   public_net {
     ipv4_enabled = true
@@ -54,7 +56,9 @@ resource "hcloud_server" "services" {
     hcloud_ssh_key.deploy.id
   ]
 
-  backups = false
+  backups            = true
+  delete_protection  = true
+  rebuild_protection = true
 
   public_net {
     ipv4_enabled = true