disaster-recovery.md: Layer 1 explicitly covers LXCs too now

Small, precise clarification - the table row was always worded
generically ('a host', not 'a VM') so it was never technically wrong,
just aspirational for LXC hosts before Terraform could provision them
natively. Now genuinely true for both, so it says so.

docs/disaster-recovery.md

@@ -13,7 +13,7 @@ A single backup tool covering everything was the simpler design, and it was reje
 
 | Layer | Covers | Explicitly does not cover |
 |---|---|---|
-| Infrastructure as Code | A host lost entirely — rebuilt from the same pipeline that built it ([`docs/iac-pipeline.md`](iac-pipeline.md)), against its existing tag-driven config | Secrets — recovered separately via Vault, see [`docs/secrets-and-pki.md`](secrets-and-pki.md), not part of this layer |
+| Infrastructure as Code | A host lost entirely, VM or LXC alike — rebuilt from the same pipeline that built it ([`docs/iac-pipeline.md`](iac-pipeline.md)), against its existing tag-driven config | Secrets — recovered separately via Vault, see [`docs/secrets-and-pki.md`](secrets-and-pki.md), not part of this layer |
 | Proxmox Backup Server | Full VM/LXC backups, including the secrets platform's own seal state and Vault's own data described in [`docs/secrets-and-pki.md`](secrets-and-pki.md) | One host's Docker volume data, a large media storage pool, personal data |
 | Kopia | The gap the layer above leaves — every stack's databases, uploaded files, and app config on the fleet's largest host, covering the ~55 stacks in [`stacks/`](../stacks/) | Anything outside that one host |