Fix nightly borgmatic backups failing for 2 days. The shower SQLite
dump hook referenced `kubectl --context=k3s-ringtail`, but indri's
kubeconfig deliberately doesn't carry the ringtail credentials. The
`before_backup` hook's failure aborted the entire run, taking out
*both* the local sifaka repo and the BorgBase offsite. Rewrite the
shower dump to ssh into ringtail and run `k3s kubectl` there
(k3s.yaml on ringtail is mode 644, so no sudo needed); fetch the
dump file back via scp. The borgmatic role's k8s-dump template now
branches on a new `ssh_host` field — entries without it keep using
local kubectl with the existing `context` field (e.g. mealie).