feat(worker): R2 — extend customer-backup ladder to mongodb + redis

[mastermanas805]

What & why

The customer-backup ladder backed up postgres/vector ONLY
(customer_backup_scheduler.go enqueued resource_type IN ('postgres','vector')),
but the product sells "backups + 1-click restore" for ALL paid resources.
Mongo/Redis had ZERO automated backup — the durability gap flagged in the
worker #103 note + GAP-AUDIT-2026-06-10. This closes it by mirroring the
existing pg/vector path (same cadence / retention / tier-gating / S3 sink /
<1KB sanity guard, all via the shared pipeline) for the new types.

What's backed up now

Resource	Backup	Restore
postgres / vector	✅ (unchanged)	✅ (unchanged)
mongodb	✅ mongodump --archive → gzip → S3	✅ mongorestore --archive --drop
redis	✅ redis-cli --rdb - → gzip → S3	⏳ follow-up (backup-only)

Redis backup ships (taken, sha-verified, retained, downloadable). Redis
restore is the tracked follow-up: an RDB restore-in-place needs pod-level
access (replace dump.rdb + restart, or a per-key RESTORE pass) that the
worker can't drive from outside the pod. The restore runner marks a redis
restore row failed with that explicit reason before any S3 download.

Key design decisions

• One pipeline, one object layout. Every dump strategy writes a RAW
  (uncompressed) archive into the runner's existing gzip writer — mongodump --archive (NOT --gzip, which would double-compress under the pipeline's
  gzip and break the gunzip→mongorestore symmetry), redis-cli --rdb -
  streams the RDB to stdout. Object key, sha256-of-gzip, retention, keep-last-N,
  and restore-gunzip logic are unchanged.
• Secret hygiene (mirrors SEC-WORKER FINDING-2 PGPASSWORD on the pg path):
  the customer credential never sits in argv during the backup window. Mongo
  URI is passed via a 0600 mongodump --config file; Redis password via the
  REDISCLI_AUTH env. Both fail open to argv on a parse/temp-file error
  (strictly better than no backup), same posture the pg path documents.
• Fail-open dispatch. A nil strategy or unsupported type → markFailed
  reason=config, never a panic. The scheduler SQL only enqueues supported
  types; the runner guard is defence-in-depth for a manual API backup.
• Single source of truth for "what's backed up": backupSupportedResourceType()
  anchors both the scheduler SQL set and the runner dispatch (root rule 16/18).

Metrics (rule 25)

New instant_customer_backup_by_type_total{resource_type, result} — per-type
success/failure so "Mongo backing up but Redis silently failing" is visible
(the aggregate *_succeeded_total / *_failed_total counters are retained for
the existing dashboard + customer-backup-failed.json alert). Primed for all
(type,result) pairs in metrics_test.go so the lazy *Vec series render from
process start.

Dockerfile

apk add --no-cache mongodb-tools redis — postgres:16-alpine ships pg_dump
only; without these the new exec calls would fail at runtime (the runner
fail-opens, but no Mongo/Redis backup would actually succeed).

Tests (all green)

Scheduler: TestScheduler_EnqueuesMongoAndRedisForProTier,
TestScheduler_FreeTierMongoNeverEnqueued,
TestScheduler_FreeMongoGate_SkipsEvenIfRowLeaksThrough,
TestScheduler_SQLFilterIncludesAllSupportedTypes.
Runner: TestRunner_MongoHappyPath, TestRunner_RedisHappyPath,
TestRunner_UnsupportedType_MarksFailed, TestDumpForResourceType_Dispatch,
TestBackupSupportedResourceType.
Dump cmd: TestRealMongoDumpRunner_ConfigFileKeepsURIOutOfArgv,
TestRealRedisDumpRunner_PasswordViaEnv, TestRealMongoRestoreRunner_DropAndArchive,
TestSplitRedisURL, TestWriteMongoConfig.
Restore: TestRestoreForResourceType_Dispatch, TestRestoreRunner_MongoHappyPath,
TestRestoreRunner_RedisUnsupported_MarksFailed.

Gate: go build ./... && go vet ./... && go test ./... -short -count=1 green;
real gofmt clean (touched files); golangci-lint 0 issues.

Operator follow-ups (separate infra repo — no auto-apply)

1. Rule 25 monitoring for instant_customer_backup_by_type_total: Prom rule
   in prometheus-rules.yaml (per-type success-ratio < threshold, P1 — data
   durability), NR alert JSON, dashboard tile (stacked by resource_type), and
   a METRICS-CATALOG.md row.
2. Object-storage (DO Spaces) bucket backup — bucket versioning / cross-region
   replication; infra/operator, not worker code (out of scope per the brief).
3. Redis RESTORE — the tracked follow-up (see above).
4. Durability COPY must read "Postgres / vector / mongo" for full
   backup+restore and flag Redis as backup-only until Redis restore ships.

🤖 Generated with Claude Code