P2-ops: migration alignment, deploy test list, monitor alerts/single-host, backup/rollback closure, Caddy template

- migrations: MIGRATION_TABLES now equals POSTGRES_SCHEMA tables
  (uploads, task_attachments, task_followups, environments added);
  SEQUENCE_TABLES matches IDENTITY tables; task_followups
  sender_task_id column ensured before insert; UNMIGRATED_TABLES
  and migration_coverage() report tables with no PG schema instead
  of silently skipping them; CLI prints the coverage report.
- deploy: DEFAULT_TEST_SUITES gains deploy/tests (discover -s only,
  never package path); regression tests pin the default list.
- monitor: MONITOR_SINGLE_HOST=1 makes the server check single-host;
  default stays dual to avoid silent downgrade; server_mode is in
  the JSON. Optional fail-only alert outlet (webhook or mail,
  default off, alert body is pass/fail JSON only, no secrets).
- backup/rollback: README and restore-drill document what is
  recoverable (DB, code) vs not (worktrees, traces, uploads, host
  configs); rollback.sh shares the server-unit list and dual-port
  health success standard with host_deploy.sh (sync test guards it).
- public entry: Caddyfile uses native {$DOMAIN}/{$ACME_EMAIL}
  variables plus a caddy.service template; README documents the
  steps and the current BT-nginx production status.

deploy/restore-drill.sh

@@ -4,6 +4,12 @@
 # 用法（主机上）：sh /opt/codex-app-server/deploy/restore-drill.sh
 #   可选环境变量：BACKUP_DIR（默认 /var/lib/codex-app-server/backups）。
 #
+# 演练范围（P2-ops，诚实边界）：本演练只证明“数据库备份可恢复”
+# （行数比对通过）。它不证明 worktree / 链路 / 上传文件可恢复，
+# 因为那些根本不在备份里（见 deploy/README.md“备份制度”一节）：
+# 代码备份 tar 明确排除 work/，pg-backup 只备数据库。不要把
+# “恢复演练 PASS”读成“整机可恢复”。
+#
 # 步骤：
 #   1. 跑一次 backup_postgres 生成新鲜备份（.sql）。
 #   2. 新建一个测试库 codex_control_restore_test_<时间戳>，用