ops: add production observability and recovery

infra/scripts/verify-backup.ps1

@@ -0,0 +1,38 @@
+[CmdletBinding()]
+param(
+    [Parameter(Mandatory = $true)]
+    [string]$BackupDirectory
+)
+
+$ErrorActionPreference = "Stop"
+$target = (Resolve-Path -LiteralPath $BackupDirectory).Path
+$requiredFiles = @(
+    "SHA256SUMS",
+    "postgres.dump",
+    "postgres.contents",
+    "minio-data.tar.gz",
+    "manifest.txt"
+)
+foreach ($file in $requiredFiles) {
+    if (-not (Test-Path -LiteralPath (Join-Path $target $file) -PathType Leaf)) {
+        throw "备份缺少文件：$file"
+    }
+}
+
+foreach ($line in Get-Content -LiteralPath (Join-Path $target "SHA256SUMS")) {
+    if ($line -notmatch "^([0-9a-fA-F]{64})\s{2}(.+)$") {
+        throw "SHA256SUMS 格式无效：$line"
+    }
+    $expected = $Matches[1].ToLowerInvariant()
+    $file = $Matches[2]
+    $path = Join-Path $target $file
+    if (-not (Test-Path -LiteralPath $path -PathType Leaf)) {
+        throw "校验文件不存在：$file"
+    }
+    $actual = (Get-FileHash -Algorithm SHA256 -LiteralPath $path).Hash.ToLowerInvariant()
+    if ($actual -ne $expected) {
+        throw "备份校验失败：$file"
+    }
+}
+
+Write-Output "备份校验通过：$target"