HH-441: harden durable storage and recovery (#92)

* HH-441: harden durable storage and recovery

* HH-441: clear recovery review blockers

* HH-441: enforce offsite backup failure domain

---------

Co-authored-by: Rogee <rogee@ipao.vip>

deploy/docker/Dockerfile

@@ -50,6 +50,9 @@ RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
     -X github.com/gochat/gochat/internal/config.BuildDate=${BUILD_DATE}" \
     -o /gochat-worker ./cmd/gochat/
 
+RUN CGO_ENABLED=0 GOOS=linux GOARCH=amd64 \
+    go build -ldflags="-s -w" -o /migrate ./cmd/migrate/
+
 # ========== Production Stage ==========
 FROM alpine:3.21
 
@@ -60,17 +63,20 @@ LABEL org.opencontainers.image.version="${VERSION}" \
       org.opencontainers.image.revision="${COMMIT_SHA}" \
       org.opencontainers.image.created="${BUILD_DATE}"
 
-# Install runtime dependencies
-RUN apk --no-cache add ca-certificates tzdata curl &&     addgroup -S gochat && adduser -S gochat -G gochat
+# Install runtime and recovery dependencies.
+RUN apk --no-cache add bash ca-certificates tzdata curl openssl postgresql16-client && \
+    addgroup -S gochat && adduser -S gochat -G gochat
 
 WORKDIR /app
 
 # Copy binary and configs from builder
 COPY --from=builder /gochat /app/gochat
 COPY --from=builder /gochat-worker /app/gochat-worker
+COPY --from=builder /migrate /app/migrate
 COPY --chown=gochat:gochat --from=frontend-builder /app/frontend/dist /app/frontend/dist
 COPY backend/configs/ /app/configs/
 COPY backend/migrations/ /app/migrations/
+COPY backend/scripts/db_backup.sh backend/scripts/db_restore.sh /app/scripts/
 
 ENV GOCHAT_FRONTEND_DIST=/app/frontend/dist