P2-ops: migration alignment, deploy test list, monitor alerts/single-host, backup/rollback closure, Caddy template

- migrations: MIGRATION_TABLES now equals POSTGRES_SCHEMA tables
  (uploads, task_attachments, task_followups, environments added);
  SEQUENCE_TABLES matches IDENTITY tables; task_followups
  sender_task_id column ensured before insert; UNMIGRATED_TABLES
  and migration_coverage() report tables with no PG schema instead
  of silently skipping them; CLI prints the coverage report.
- deploy: DEFAULT_TEST_SUITES gains deploy/tests (discover -s only,
  never package path); regression tests pin the default list.
- monitor: MONITOR_SINGLE_HOST=1 makes the server check single-host;
  default stays dual to avoid silent downgrade; server_mode is in
  the JSON. Optional fail-only alert outlet (webhook or mail,
  default off, alert body is pass/fail JSON only, no secrets).
- backup/rollback: README and restore-drill document what is
  recoverable (DB, code) vs not (worktrees, traces, uploads, host
  configs); rollback.sh shares the server-unit list and dual-port
  health success standard with host_deploy.sh (sync test guards it).
- public entry: Caddyfile uses native {$DOMAIN}/{$ACME_EMAIL}
  variables plus a caddy.service template; README documents the
  steps and the current BT-nginx production status.

deploy/caddy/caddy.service

@@ -0,0 +1,24 @@
+# Caddy 前置代理 unit 模板（与 deploy/caddy/Caddyfile 配对）。
+#
+# 注意：unit 文件不在 deploy tar 里（与 codex-cloud-server-2.service
+# 同款约束），改动后须单独放到 /etc/systemd/system/ 再
+# daemon-reload + enable + start；只重启 Caddy 不会生效。
+# EnvironmentFile 指向 /etc/caddy/env（600，部署时按
+# deploy/README.md“公网入口”一节手写 DOMAIN / ACME_EMAIL，
+# 域名与邮箱不要写进仓库）。Caddyfile 里的 {$DOMAIN} /
+# {$ACME_EMAIL} 由 Caddy 运行时从该环境展开。
+[Unit]
+Description=Codex public entry (Caddy reverse proxy + automatic TLS)
+After=network.target
+
+[Service]
+User=caddy
+Group=caddy
+EnvironmentFile=/etc/caddy/env
+ExecStart=/usr/bin/caddy run --config /etc/caddy/Caddyfile --adapter caddyfile
+ExecReload=/usr/bin/caddy reload --config /etc/caddy/Caddyfile --adapter caddyfile
+Restart=on-failure
+RestartSec=10
+
+[Install]
+WantedBy=multi-user.target