feat(v2): complete v2 reimplementation

docs/runbooks/metadata.md

@@ -0,0 +1,19 @@
+# Metadata backup and restore runbook
+
+## Backup
+
+1. Confirm `docker compose ps` shows exactly one scheduler and one worker.
+2. For an online SQLite backup, run a host-side SQLite `.backup` against the mounted
+   `metadata.db`; do **not** copy only the main file while WAL writers run.
+3. For a filesystem copy, stop `web`, `scheduler`, and `worker` first, then retain
+   `metadata.db`, `metadata.db-wal`, and `metadata.db-shm` together.
+4. Encrypt and test the backup outside the appliance. Never place a database dump in
+   the repository or OCI image.
+
+## Restore
+
+1. Stop all runtime roles and preserve the failed metadata volume unchanged.
+2. Restore the complete SQLite backup into the metadata volume with the service user
+   ownership (UID 10001 in the supplied Compose deployment).
+3. Run `docker compose run --rm migrate current`; only start the stack when it reports
+   the expected revision. Validate `/readyz` and a read-only API request after startup.