feat: enhance chat service with Redis pub/sub for multi-instance message handling, add instance ID for deduplication

.github/instructions/BACKLOG.md

@@ -1,5 +1,7 @@
 # BACKLOG
 
+Status reflects 2026-08-06 code scan + implementation batches.
+
 ## Playout & Delivery
 
 - [x] Implement FFmpeg + MediaMTX/SRS continuous HLS playout from playlist
@@ -55,15 +57,15 @@
 ## Infrastructure — Docker
 
 - [x] Create Dockerfiles for playout, chat, nginx services
-- [x] Create docker-compose.yml for all services
+- [x] Create docker-compose.yml for all services (11 containers)
 - [x] Create docker-compose.prod.yml override for production
 
 ## Infrastructure — CI/CD (Gitea Actions)
 
-- [x] Implement CI workflow (lint, build, test, push images)
+- [x] Implement CI workflow (lint, build, vet, push images)
 - [x] Implement CD workflow (pull, deploy, health checks — IP-agnostic)
 - [x] Generate .env from Gitea secrets in CD workflow
-- [x] Seed Prometheus config into named volume during deploy
+- [x] Seed Prometheus config + alerts into named volume during deploy
 - [x] Implement health check validation with retry in CD pipeline
 
 ## Cloudflare Configuration
@@ -79,10 +81,10 @@
 
 ## Monitoring & Observability
 
-- [x] Set up Prometheus with chat scrape target
-- [ ] Add nginx/redis/postgres/node exporters
+- [x] Set up Prometheus with chat/playout/nginx/redis/postgres/node scrape targets
+- [x] Add nginx-exporter, redis-exporter, postgres-exporter, node-exporter
 - [x] Import Grafana app + operational dashboards
-- [ ] Define Prometheus alerting rules
+- [x] Define Prometheus alerting rules (8 rules: ChatDown, PlayoutDown, RedisDown, etc.)
 - [ ] Set up UptimeRobot external monitoring
 
 ## Security
@@ -90,15 +92,18 @@
 - [x] Implement admin cookie-session auth (HttpOnly, SameSite=Strict, Secure when TLS)
 - [x] Implement server-side session expiration
 - [ ] Enforce HTTPS/WSS at edge and origin
-- [x] Implement rate limiting for chat messages with Redis windowing
+- [x] Implement rate limiting for chat messages (Redis windowing)
+- [x] Implement WebSocket connection rate limiting (5/IP/60s)
+- [x] Implement admin login rate limiting (5/IP/5min)
 
 ## Data & Storage
 
 - [x] Set up PostgreSQL/SQLite for chat history and moderation data
 - [x] Set up Redis with append-only persistence + maxmemory policy
-- [ ] Implement daily/weekly/monthly Postgres backups
-- [ ] Implement backup integrity verification
-- [ ] Document and rehearse recovery runbook
+- [x] Implement daily Postgres backups to R2 (14-day retention)
+- [x] Implement weekly full backup snapshots (8-week retention)
+- [x] Implement backup integrity verification (restore test)
+- [ ] Document and rehearse recovery runbook (quarterly drill)
 
 ## Scaling & Performance
 
@@ -117,5 +122,5 @@
 - [ ] Document deployment runbook in DEPLOYMENT.md
 - [ ] Document monitoring setup in MONITORING.md
 - [ ] Document security model in SECURITY.md
-- [ ] Create incident runbook
+- [x] Create incident runbook (docs/incident-runbook.md)
 - [ ] Write Level 2/3 building block views