Prevent concurrent PayGate SQLite access

[Phloraxx]

Incident

Production checkout degraded again on 2026-08-31 with SQLite disk I/O error (522) while the stored databases and restored backup remained healthy. The strongest trigger correlation was the host backup-export cron invoking a second /app/paygate backup-verify process against the live pb_data directory.

Fix

• acquire a non-blocking exclusive .paygate-process.lock before constructing PocketBase
• fail closed if another PayGate process already owns the data directory
• keep standalone healthcheck outside the data-directory lock
• version the production-safe host backup exporter, which validates completed backup ZIPs and restored SQLite copies without invoking PayGate
• document the incident, timing, evidence, and mitigation

Validation

• process-lock exclusion/reacquire tests ✅
• frontend production build ✅
• go test ./... ✅
• go vet ./... ✅
• git diff --check ✅
• production host exporter is byte-identical to the versioned script and has already successfully verified today's backup without starting a second PayGate process ✅

Production currently remains on the existing v3 image; deployment of this hotfix is separate and gated.