Add verified recovery operations and FORGE branding

[BlinkStreamTeam]

What changed

• add forge-resilience 0.2.0 with streaming AES-256-GCM logical backup, authenticated manifests, verification and transactional restore
• add single-run locking, verified filesystem replication, safe retention, atomic health and a DPAPI-backed six-hour Windows schedule
• add collision-safe WAL archive/restore helpers and an isolated SHA-256 pg_basebackup named-target PITR drill
• add a dedicated least-privilege backup role setup and fail-closed permission preflight
• reject non-empty or older restore targets and verify migration checksums and all FORGE table counts after restore
• integrate the approved geometric brand pack into the repository and Workbench favicon/rail identity
• add explicit static-asset MIME/whitelist coverage, PowerShell parsing in Windows CI, operator docs and ADR-005/ADR-006

Why

FORGE must be recoverable after process, database, disk or machine replacement before it can be considered Core Complete. Backup creation alone is insufficient: copies must authenticate, retention must be failure-safe and physical WAL recovery must be drilled rather than claimed.

Implementation findings

• the application runtime role intentionally lacked access to every relation; backup now uses a separate read-only role
• rejected restore preflights leaked a PostgreSQL client; every rejection now closes it
• Windows WAL hashing required file-sharing flags compatible with the running server
• pg_ctl -w signals connection readiness before PITR promotion, so the drill now waits for pg_is_in_recovery() = false
• Windows PowerShell 5.1 lacks a newer .NET path API and writes UTF-8 JSON with BOM; both boundaries now have regressions
• Workbench's static test path was invalid and its whitelist did not yet include brand assets

Validation

• npm run check: 58/58 monorepo tests passed and every workspace built
• npm run audit:production: 0 vulnerabilities
• 8 Resilience PowerShell scripts parse under Windows PowerShell 5.1
• native PostgreSQL 18.4 logical drill: backup/authentication, verified replica, non-destructive refusal, transactional restore, checksum/count verification and cleanup passed
• native PostgreSQL 18.4 PITR drill: SHA-256 base backup, continuous WAL archive, named restore target, promotion and data proof passed
• installed Windows task: limited CurrentUser, DPAPI secrets, three live runs returned zero with independently authenticated D:/E: package pairs
• npm pack --dry-run: CLI, policy example and all operator/PITR scripts included
• git diff --check: passed

Deliberately not claimed

The installed E: replica is a different physical disk but remains in the same PC. NAS/cloud replication, automatic failover and production-cluster WAL activation require deployment-specific storage, credentials, capacity and monitoring and are not misrepresented as complete.