docs(ops): record nginx exporter recovery [skip ci]

scripts/ops/188-nginx-exporter-restore.sh

@@ -0,0 +1,49 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+REMOTE="${NGINX_EXPORTER_REMOTE:-ollama@192.168.0.188}"
+COMPOSE_FILE="${NGINX_EXPORTER_COMPOSE_FILE:-/home/ollama/nginx-exporter.yml}"
+STUB_STATUS_URL="${NGINX_EXPORTER_STUB_STATUS_URL:-http://127.0.0.1:8080/nginx_status}"
+METRICS_URL="${NGINX_EXPORTER_METRICS_URL:-http://127.0.0.1:9113/metrics}"
+
+MODE="check"
+if [[ "${1:-}" == "--apply" ]]; then
+  MODE="apply"
+elif [[ "${1:-}" != "" && "${1:-}" != "--check" ]]; then
+  echo "usage: $0 [--check|--apply]" >&2
+  exit 2
+fi
+
+remote_script='
+set -euo pipefail
+mode="$1"
+compose_file="$2"
+stub_status_url="$3"
+metrics_url="$4"
+
+echo "== nginx stub_status =="
+curl -fsS --max-time 5 "$stub_status_url" | head -5
+
+echo "== exporter compose =="
+test -s "$compose_file"
+docker compose -f "$compose_file" config >/dev/null
+
+echo "== exporter state before =="
+docker ps -a --filter name=nginx-exporter --format "{{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}" || true
+
+if [[ "$mode" == "apply" ]]; then
+  echo "== restore nginx-exporter =="
+  docker compose -f "$compose_file" up -d
+  sleep 3
+fi
+
+echo "== exporter metrics =="
+curl -fsS --max-time 5 "$metrics_url" | grep -E "^(nginx_up|nginx_connections_active|nginx_http_requests_total)" | head -10
+
+echo "== exporter state after =="
+docker ps --filter name=nginx-exporter --format "{{.Names}}\t{{.Image}}\t{{.Status}}\t{{.Ports}}"
+'
+
+ssh -o BatchMode=yes -o ConnectTimeout=8 "$REMOTE" \
+  "bash -s" -- "$MODE" "$COMPOSE_FILE" "$STUB_STATUS_URL" "$METRICS_URL" \
+  <<<"$remote_script"

scripts/security/high-value-config-change-gate.py

@@ -269,6 +269,7 @@ CATEGORIES = [
             "ops/sentry-self-hosted/**",
             "infra/langfuse/**",
             "k8s/monitoring/**",
+            "scripts/ops/**/*exporter*",
         ),
         required_validation=(
             "rule_diff",