resident P0+P1: DNS-level SSRF pin, batch budget, daily cap/cooldown/retention, PG schema/migration, dual-connection deadlock isolation, retarget baseline reset, proxy and structured failures, metrics

- DNS 级 SSRF pin：解析后 pin IP 建连，防 DNS 重绑定
- 批量总预算与每日上限/抖动冷却/保留期
- PG schema 与迁移清单
- 双连接死锁隔离
- 改目标重置基线
- 显式代理配置与结构化失败原因
- /metrics resident 口径

cloud/db.py

@@ -1044,6 +1044,49 @@ POSTGRES_SCHEMA = (
     "status TEXT, "
     "requested_at DOUBLE PRECISION, "
     "done_at DOUBLE PRECISION)",
+    # 常驻监听（P0 S3：此前只由 resident.ensure_resident_tables
+    # 运行时懒建，POSTGRES_SCHEMA 与迁移清单里没有；本批正式
+    # 写进 schema，与 ensure 的 CREATE 语句列一一对应，含
+    # P1 新增的 resident_polls.failure_reason 列；TEXT 主键/
+    # 复合部分唯一索引，无身份列，不需要序列拨动）。
+    "CREATE TABLE IF NOT EXISTS resident_watches("
+    "id TEXT PRIMARY KEY, "
+    "project_id TEXT, "
+    "name TEXT, "
+    "target_url TEXT, "
+    "prompt TEXT, "
+    "interval_seconds BIGINT, "
+    "fetch_timeout_seconds BIGINT, "
+    "status TEXT, "
+    "last_poll_at DOUBLE PRECISION, "
+    "last_claimed_at DOUBLE PRECISION, "
+    "next_poll_at DOUBLE PRECISION, "
+    "last_content_hash TEXT, "
+    "last_change_at DOUBLE PRECISION, "
+    "last_change_text TEXT, "
+    "consecutive_failures BIGINT, "
+    "paused_reason TEXT, "
+    "ended_at DOUBLE PRECISION, "
+    "created_by TEXT, "
+    "created_at DOUBLE PRECISION, "
+    "updated_at DOUBLE PRECISION)",
+    "CREATE INDEX IF NOT EXISTS idx_resident_watches_project"
+    " ON resident_watches(project_id, status)",
+    "CREATE UNIQUE INDEX IF NOT EXISTS idx_resident_watches_name"
+    " ON resident_watches(project_id, name)"
+    " WHERE status != 'ended'",
+    "CREATE TABLE IF NOT EXISTS resident_polls("
+    "id TEXT PRIMARY KEY, "
+    "watch_id TEXT, "
+    "project_id TEXT, "
+    "status TEXT, "
+    "observed_hash TEXT, "
+    "detail TEXT, "
+    "task_id TEXT, "
+    "created_at DOUBLE PRECISION, "
+    "failure_reason TEXT)",
+    "CREATE INDEX IF NOT EXISTS idx_resident_polls_watch"
+    " ON resident_polls(watch_id, created_at)",
 )