make backup-firewall is not declared .PHONY

[Gerrrt]

Makefile:265-272:

.PHONY: backup
backup-firewall: ## Pull morpheus's pfSense config and encrypt it to ./backups/
	...
	./scripts/backup-firewall.sh $(ARGS)

backup: ## Back up the stack's volumes to ./backups/

The .PHONY: backup line sits immediately above backup-firewall: while the
target it actually declares is six lines further down. Every other phony
declaration in the file is on the line directly above its own target, so this one
reads as belonging to backup-firewall — and backup-firewall is the one target
in the pair that is not declared phony:

$ grep -c '^\.PHONY:.*backup-firewall' Makefile
0

Consequence today: none. There is no file or directory named backup-firewall in
the repository root, so make runs the recipe. It stops working the moment one
exists — make backup-firewall would report "Nothing to be done" and silently
skip the pfSense config export, which
docs/roadmap.md calls the single largest unmitigated failure
in the estate. A backup target that quietly does nothing is the worst available
version of this bug.

Fix is one line: move .PHONY: backup to sit above backup: and add
.PHONY: backup-firewall above backup-firewall:.

Worth a look at the same time: whether any other target in the file is missing
its declaration. There are 20 .PHONY lines; a quick cross-check against the
target list would say whether this is the only one.

Noticed while working on #12 — unrelated to that change, so not fixed there.