Production-grade: webhook execution, Postgres backup, rate limit, worker timeout/retry

GitHub webhook: delivery-id dedup persisted in webhook_deliveries,
/fix-review creates a queued task with audit (no model run in the
webhook itself), check_run/check_suite parsing without mutating
task state (CI backfill still via pr-checks).
Control plane: Postgres pg_dump backup branch + POST /admin/backup
(maintainer+, password only via PGPASSWORD env), per-key/IP rate
limit (default 120/min, 429), health returns backend + db_ok,
metrics by_status always has all seven status keys.
Worker: per-task timeout (default 1800s, --task-timeout), timeout
is failed not interrupted, limited retries (default 1, backoff,
fallback failures not re-retried), stale codex- container cleanup
on loop/CLI start.
Tests: cloud 271 (267 pass, 4 skipped are pre-existing real-
Postgres tests), host 27 pass.

cloud/tests/test_server.py

@@ -96,8 +96,12 @@ class ServerTestCase(unittest.TestCase):
     def test_health_no_auth(self):
         status, body = self._req("GET", "/health")
         self.assertEqual(status, 200)
-        self.assertEqual(
-            body, {"ok": True, "service": "cloud-control-plane"})
+        # health 除 ok/service 外还返回 backend 与 db_ok（加法字段，
+        # 不是改成功语义）；旧的精确全等断言已随字段扩展而放宽。
+        self.assertTrue(body["ok"])
+        self.assertEqual(body["service"], "cloud-control-plane")
+        self.assertEqual(body["backend"], "sqlite")
+        self.assertTrue(body["db_ok"])
 
     def test_no_key_401(self):
         status, body = self._req("GET", "/projects")