feat(ops): W4-B single-container packaging, DATA_DIR, backup/restore

- DATA_DIR (/data: agent-sessions, backups, exports, tmp); entrypoint chowns it
  to PUID/PGID then drops privileges via gosu; /app binary stays root read-only
- compile with --allow-read --allow-write so mounted library roots are writable
- preflight: DATA_DIR/session dir must be writable (fatal); enabled library
  roots and downloader path mappings checked read/write (warn + audit)
- --role export-mappings (mapping manifest JSON, --compare row counts) and
  --role read-only-on (automation.readOnlyReconcile=true + audit)
- scripts/backup.sh (pg_dump custom + mappings + agent sessions, SHA256SUMS,
  BACKUP_KEEP rotation) and scripts/restore.sh (checksum, refuses with live
  connections, psql single-transaction replay compatible with PG16, read-only
  reconcile on, row-count verification)
- compose: app + postgres only, data volume, env example with key generation
- docs: runbook deploy.md, backup-restore.md with verification record

Co-Authored-By: Claude Opus 5.5 <[email protected]>

README.md

@@ -16,7 +16,20 @@ deno task dev         # API http://localhost:4380  控制台 http://localhost:51
 
 提交前:`deno task ci`(typecheck:tsc 7.0.2 + deno check → biome → vitest → check:tokens → web 构建 + server 编译)。
 
-生产/试运行:`docker compose up -d --build`(单容器 app + postgres,见 [docs/runbook/dev.md](docs/runbook/dev.md#docker-单容器部署))。
+## 部署
+
+除 PostgreSQL 外全部在一个容器里(api + worker + web 静态,单端口 4380);compose 只有 `app` + `postgres`。
+
+```sh
+cp docker/compose.env.example .env    # 填 SECRET_MASTER_KEY=$(openssl rand -hex 32)、POSTGRES_PASSWORD
+docker compose up -d --build
+docker compose logs app | grep 'setup token'   # 首次初始化管理员
+docker compose exec app umt backup             # 备份到 /data/backups/<时间戳>/
+```
+
+- 应用数据卷 `/data`(Agent 会话、备份、导出);媒体库根与下载目录自行 bind mount,需对 `PUID:PGID`(缺省 10001)可读写。
+- `SECRET_MASTER_KEY` 不在备份里,和备份分开保管。
+- 详见 [docs/runbook/deploy.md](docs/runbook/deploy.md) 与 [docs/runbook/backup-restore.md](docs/runbook/backup-restore.md)。
 
 更多见 [docs/runbook/dev.md](docs/runbook/dev.md)。
 
@@ -38,7 +51,8 @@ deno task dev         # API http://localhost:4380  控制台 http://localhost:51
 | `docs/design` | 设计系统规范 |
 | `docs/runbook` | 运行手册 |
 | `config/` | tsc 7 用的 tsconfig 基座(根目录不放 tsconfig.json,否则 `deno check` 丢 Deno 全局) |
-| `docker/` | 容器入口脚本 |
+| `docker/` | 容器入口脚本、compose 环境变量示例 |
+| `scripts/` | 备份 / 恢复脚本(镜像内 `/app/scripts/`) |
 | `spikes/` | 独立兼容性验证(不属于 workspace) |
 
 技术选型:Deno 2.9.7(锁定)+ TypeScript 7.0.2 strict,deno.json workspace(`nodeModulesDir: auto`,npm 依赖版本统一登记在根 `deno.json` 的 `imports`,`deno.lock` 锁定)。前端 Vite 7 + React Router 7 由 Deno 执行。决策见 [ADR-004](docs/adr/ADR-004-deno-runtime.md)(取代 ADR-001)。