fix: harden ops runbooks and execution

runbooks/cpa_usage_backup.yaml

@@ -0,0 +1,38 @@
+version: 1
+name: cpa_usage_backup
+description: 实时导出 usage 并打包备份（公网管理接口）
+inputs: []
+steps:
+  - id: export_and_package
+    action: shell.exec
+    on_fail: stop
+    with:
+      command: |
+        CPA_TOKEN=${env.cpa_management_token}
+        CPA_BASE=https://cpa.pao.xx.kg/v0/management
+        ts=$(date +%F_%H%M%S)
+        out=/root/cliproxyapi/usage_export_${ts}.json
+        curl -sS -H "Authorization: Bearer ${CPA_TOKEN}" ${CPA_BASE}/usage/export -o ${out}
+
+        echo ${out}
+
+        latest=$(ls -1t /root/cliproxyapi/usage_export_*.json | head -n 1)
+        ts=$(date +%Y-%m-%d_%H%M%S)
+        out=/root/backups/cpa-runtime-daily/hwsg_usage_realtime_${ts}.tar.gz
+        meta=/root/backups/cpa-runtime-daily/hwsg_usage_realtime_${ts}.meta.txt
+        mkdir -p /root/backups/cpa-runtime-daily
+        tar -czf ${out} ${latest}
+        sha=$(sha256sum ${out} | awk '{print $1}')
+        size=$(du -h ${out} | awk '{print $1}')
+        req=$(python3 -c "import json; data=json.load(open('${latest}','r',encoding='utf-8')); u=data.get('usage',{}); print(u.get('total_requests', data.get('total_requests','unknown')))" )
+        tok=$(python3 -c "import json; data=json.load(open('${latest}','r',encoding='utf-8')); u=data.get('usage',{}); print(u.get('total_tokens', data.get('total_tokens','unknown')))" )
+        {
+          echo "time=$(date '+%F %T %z')"
+          echo "source=${latest}"
+          echo "backup=${out}"
+          echo "sha256=${sha}"
+          echo "size=${size}"
+          echo "total_requests=${req}"
+          echo "total_tokens=${tok}"
+        } > ${meta}
+        cat ${meta}