Health-routing hysteresis, backup checksum verification, DR automation hooks, slice inheritance entry points

[richardiyamura]

Summary

Addresses four issues:

#374 — Health-Based Routing Flapping Prevention
health_routing.rs marked an endpoint healthy again as soon as it recorded a single success, since is_healthy() was derived directly from consecutive_failures (which resets to 0 on any success). That let a backend flap in and out of rotation. Added a sticky healthy flag with two separate thresholds: UNHEALTHY_THRESHOLD (5 consecutive failures) marks it unhealthy, RECOVERY_THRESHOLD (3 consecutive successes) marks it healthy again — a real hysteresis band instead of a single threshold read both ways. Documented in docs/health-based-routing.md.

#375 — Backup Validation Checksum Verification
backup_validation.rs only checked file presence/magic-bytes and a simulated restore, not whether the bytes had silently changed since backup creation. Added BackupValidator::compute_checksum (SHA-256), a BackupChecksumRecord to pair a backup with the checksum recorded at creation time, and validate_backup_with_checksum, which fails validation and opens a Sev2 incident via the (previously unregistered) incidents module on a mismatch.

#376 — Disaster Recovery Runbook Automation Hooks
Added a new dr_automation module exposing the runbook's highest-risk manual steps (pause, unpause, restore_vault) as admin endpoints, gated by a two-phase confirmation-token flow (POST /admin/dr/actions → token, POST /admin/dr/actions/:token/confirm → executes, 5-minute expiry) so a destructive action can't fire from a single accidental request. Each confirmed action shells out to the same stellar contract invoke commands already documented in the runbook. docs/disaster-recovery-runbook.md updated to reference the new API alongside the manual steps.

#377 — Saga Compensation Idempotency Guarantee
saga.rs's CompensationRegistry had no memory of which compensations had already run,
so retrying a saga after a crash (or an external system retrying the same logical
operation) could re-invoke a compensation that already succeeded — e.g. double-refunding
or double-releasing a resource. CompensationRegistry now tracks, per step name,
whether that step's compensation already completed successfully; a repeat call is a
no-op instead of re-invoking the function. SagaStepRecord.compensation_already_ran
records when that guard fires. A failed compensation is deliberately left retryable.
Documented in docs/saga-pattern.md.

• No new tests were added and the build was not run, per instructions for this PR.
• incidents.rs existed on disk but wasn't declared as a module anywhere in the crate; it's now wired in via pub mod incidents; in backend/src/lib.rs since backup_validation's checksum-mismatch alerting depends on it.
• dr_automation follows the same standalone-module pattern already used by health_routing/incidents (its own Axum state, not yet wired into main.rs::build_router), consistent with how those modules currently sit in this codebase.

Closes #374
Closes #375
Closes #376
Closes #377

[drips-wave]

@richardiyamura Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[maugauwi-hash]

Merged to main via conflict resolution. All required changes integrated.