[P2][Deferred][Infra] production PostgreSQL・Hyperdrive・PITR authorityを構築する

[Hosi121]

Parent / prerequisite

• Production promotion parent: [P2][Deferred][Release] same-origin staging canaryからproduction releaseへ安全にpromotionする #434
• Staging authority prerequisite: [P2][Deferred][Infra] staging managed PostgreSQL・Hyperdrive authorityを構築する #431

Problem

Staging PostgreSQL/Hyperdrive provisioning and production durability/recovery currently share #431. This makes the staging consumers #312/#433 wait for production-only PITR and restore evidence, while #434 has no independently owned production database promotion gate.

Goal

Provision a production PostgreSQL and caching-disabled Hyperdrive authority, distinct from staging, with least-privilege credentials, repeatable migrations, encrypted backup/PITR, a bounded restore drill, and tested rotation/revocation.

Scope

• production provider, region, capacity, and isolation from staging
• private TLS connectivity from production Node and Cloudflare Hyperdrive
• separate migration owner and least-privilege account, billing, collaboration, runtime, and operations roles
• production connection budgets, statement/lock timeouts, pooling, and overload behavior
• checksum-pinned migration rollout and drift rejection
• encrypted backup retention, PITR, and one restore drill
• credential rotation, compromised-role revocation, privacy-safe observability, and recovery runbook

Acceptance criteria

• production cluster, credentials, and Hyperdrive configuration are distinct from staging
• plaintext and publicly unauthenticated database access are rejected
• application roles cannot administer schema or cross their required table privileges
• production migration rollout rejects checksum/version drift and respects non-rolling cutover ordering
• encrypted backup retention and PITR are configured
• a restore drill verifies account, editor, render, publication, and billing invariants
• credential rotation and compromised-role revocation are exercised with bounded recovery steps
• readiness fails closed on stale migration head, unavailable authority, or invalid role
• evidence records provider/version/restore boundaries without DSN, password, cookie, source, email, invitation token, or Stripe payload
• [P2][Deferred][Release] same-origin staging canaryからproduction releaseへ安全にpromotionする #434 records this reviewed authority as a production promotion prerequisite

Non-goals

• staging provisioning already owned by [P2][Deferred][Infra] staging managed PostgreSQL・Hyperdrive authorityを構築する #431
• blocking the private staging canary [P2][Deferred][Canary] same-origin stagingでaccount・billing・collaboration・exportを統合証明する #372 on production-only recovery evidence
• replacing PostgreSQL with D1
• application repository rewrites or storing object bytes in PostgreSQL