feat: add ledger backup safety workflow

confirm dcy-002 and add REQ/BAT evidence

add ledger backup/status metadata workflow

document restore as runbook/script-only guarded operation

add synthetic DB backup/restore smoke tests

docs/data-model.md

@@ -4,7 +4,7 @@
 - Baseline Seed: `.stage-pilot/bootstrap/baseline.yaml`
 - Status: draft
 - Owner: Jarca / project maintainer
-- Last Updated (KST): 2026-06-26 22:24
+- Last Updated (KST): 2026-06-27 10:17
 - Source Discovery / Batch: bootstrap-baseline
 
 ## Project Summary
@@ -118,6 +118,22 @@
 - Relationships:
   - Compared against Transaction aggregates by report functions.
 
+## Entity: LedgerBackupArtifact
+- Source of Truth: filesystem under `/root/.local/share/jarca/backups/ledger/` by default
+- Purpose: Timestamped SQLite backup artifact used for operational recovery and validation smoke checks.
+- Lifecycle: created -> listed/status-checked -> retained/pruned by policy -> optionally restored by script/runbook after approval
+- Key Evidence Fields:
+  - `path` :: text :: backup file path outside repository
+  - `size_bytes` :: integer :: file size metadata
+  - `mtime` :: text :: filesystem modification time
+  - `sha256` :: text :: file checksum
+  - `integrity_check` :: text :: SQLite integrity result
+  - `table_counts` / `aggregate_totals` :: metadata-only validation evidence
+- State Rules:
+  - Keep backups from the most recent 30 days or newest 20 files.
+  - Backup artifacts and validation DB copies must not be committed to git.
+  - Restore execution is not a persisted MCP operation and requires script/runbook approval controls.
+
 ## Consistency Rules
 - Actual cashflow reports include only categories whose `cashflow_kind` represents actual income or expense according to report semantics.
 - Account movement summaries should be separate from actual household income/expense summaries.
@@ -128,6 +144,8 @@
 
 ## Persistence Notes
 - Schema changes should be additive/idempotent unless a destructive migration is explicitly approved and backed up.
+- Operational backup/status evidence may include only path, size, mtime, checksum, integrity, row counts, and aggregate totals.
+- Validation DB copies should live outside the repository and should be selected explicitly via `JARCA_LEDGER_DB_PATH` when used.
 - Passwords for encrypted imports are runtime-only inputs and are not part of the persisted model.
 - Raw payloads may contain sensitive financial evidence and should not be committed to git.
 
@@ -138,3 +156,4 @@
 
 ## Change Log
 - 2026-06-26 22:24 KST: Created by `bootstrap-baseline` from repository observation.
+- 2026-06-27 10:17 KST: BAT-002/REQ-002 기준으로 LedgerBackupArtifact와 metadata-only evidence 정책 추가.