Phase 9: Admin & DevOps — health check, rate limiting, logging, site admin, Docker healthcheck

- Health check endpoint (GET /api/health) with DB probe and uptime
- In-memory sliding window rate limiting on login (10/60s) and register (5/3600s)
- Structured logging with pino (request timing in hooks, Socket.IO events in server.js)
- Site admin dashboard with tenant stats, CRUD, and requireSiteAdmin guard
- Tenant admin enhanced with tag and category management UI
- Docker HEALTHCHECK in Dockerfile and docker-compose.yml
- Backup documentation (docs/backup.md)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

docs/backup.md

@@ -0,0 +1,83 @@
+# Pounce — Backup & Restore
+
+Pounce runs as the **kanban** Portainer stack with:
+- App on port **3200** (container 3000)
+- PostgreSQL on port **3201** (container 5432)
+- Named volumes: `kanban_pgdata`, `kanban_uploads`
+
+## Database Backup (pg_dump)
+
+### Via docker exec (recommended)
+
+```bash
+# Find the db container name
+docker ps --filter "label=com.docker.compose.project=kanban" --format '{{.Names}}' | grep db
+
+# Dump to a local file
+docker exec <db-container> pg_dump -U kanban kanban > pounce-backup-$(date +%Y%m%d).sql
+```
+
+### Via host port
+
+```bash
+PGPASSWORD=kanban pg_dump -h 192.168.3.65 -p 3201 -U kanban kanban > pounce-backup-$(date +%Y%m%d).sql
+```
+
+### Compressed backup
+
+```bash
+docker exec <db-container> pg_dump -U kanban -Fc kanban > pounce-backup-$(date +%Y%m%d).dump
+```
+
+## Uploads Volume Backup
+
+```bash
+# Find the volume mount path
+docker volume inspect kanban_uploads --format '{{.Mountpoint}}'
+
+# Copy files out
+docker cp <app-container>:/app/uploads ./uploads-backup-$(date +%Y%m%d)
+```
+
+## Restore
+
+### Database restore (plain SQL)
+
+```bash
+# Drop and recreate (will lose existing data)
+docker exec -i <db-container> psql -U kanban -c "DROP DATABASE kanban; CREATE DATABASE kanban;"
+docker exec -i <db-container> psql -U kanban kanban < pounce-backup-20250101.sql
+```
+
+### Database restore (custom format)
+
+```bash
+docker exec -i <db-container> pg_restore -U kanban -d kanban --clean --if-exists < pounce-backup-20250101.dump
+```
+
+### Uploads restore
+
+```bash
+docker cp ./uploads-backup-20250101/. <app-container>:/app/uploads/
+```
+
+### After restore
+
+Restart the app container so Prisma picks up the restored data:
+
+```bash
+docker restart <app-container>
+```
+
+## Automated Backups (cron example)
+
+```bash
+# /etc/cron.d/pounce-backup — daily at 3 AM
+0 3 * * * root docker exec kanban-db-1 pg_dump -U kanban kanban | gzip > /backups/pounce-$(date +\%Y\%m\%d).sql.gz
+```
+
+Retain the last 14 daily backups:
+
+```bash
+find /backups -name 'pounce-*.sql.gz' -mtime +14 -delete
+```