P2-ops: migration alignment, deploy test list, monitor alerts/single-host, backup/rollback closure, Caddy template

- migrations: MIGRATION_TABLES now equals POSTGRES_SCHEMA tables
  (uploads, task_attachments, task_followups, environments added);
  SEQUENCE_TABLES matches IDENTITY tables; task_followups
  sender_task_id column ensured before insert; UNMIGRATED_TABLES
  and migration_coverage() report tables with no PG schema instead
  of silently skipping them; CLI prints the coverage report.
- deploy: DEFAULT_TEST_SUITES gains deploy/tests (discover -s only,
  never package path); regression tests pin the default list.
- monitor: MONITOR_SINGLE_HOST=1 makes the server check single-host;
  default stays dual to avoid silent downgrade; server_mode is in
  the JSON. Optional fail-only alert outlet (webhook or mail,
  default off, alert body is pass/fail JSON only, no secrets).
- backup/rollback: README and restore-drill document what is
  recoverable (DB, code) vs not (worktrees, traces, uploads, host
  configs); rollback.sh shares the server-unit list and dual-port
  health success standard with host_deploy.sh (sync test guards it).
- public entry: Caddyfile uses native {$DOMAIN}/{$ACME_EMAIL}
  variables plus a caddy.service template; README documents the
  steps and the current BT-nginx production status.

deploy/monitor.service

@@ -6,8 +6,10 @@ After=network.target codex-cloud-server.service codex-cloud-worker.service
 Type=oneshot
 User=codexsvc
 WorkingDirectory=/opt/codex-app-server
-# monitor.sh 只做检查、不读 env 文件、不发消息；失败时 systemd 会把
-# 退出码与输出记进 journal，告警通道见 deploy/README.md（另行决定）。
+# monitor.sh 只做检查、不读 env 文件；默认不发消息（告警出口默认关闭），
+# 失败时 systemd 会把退出码与输出记进 journal。可选告警出口
+# （MONITOR_ALERT_URL / MONITOR_ALERT_MAILTO）见 deploy/README.md：
+# 配了才在 fail 时发，告警内容只有 pass/fail，不含密钥。
 ExecStart=/bin/sh /opt/codex-app-server/deploy/monitor.sh
 
 [Install]