(ops) Expand native install self checks and recovery docs

Extend the runtime self check with native install diagnostics for the
environment file, service user, backup root ownership, and SQLite database
path. Export install metadata from the systemd units and pobsync-manage wrapper
so custom env files and service users are visible to Django checks.

Document restart, journal log inspection, and rollback steps in the README so
production updates have a clear recovery path.

src/pobsync_backend/tests/test_self_check.py

@@ -2,13 +2,15 @@ from __future__ import annotations
 
 import subprocess
 from io import StringIO
+from pathlib import Path
+from tempfile import TemporaryDirectory
 from unittest.mock import patch
 
 from django.core.management import call_command
 from django.core.management.base import CommandError
-from django.test import SimpleTestCase
+from django.test import SimpleTestCase, override_settings
 
-from pobsync_backend.self_check import SelfCheck, _systemd_checks
+from pobsync_backend.self_check import SelfCheck, _install_checks, _sqlite_database_check, _systemd_checks
 
 
 class SystemdSelfCheckTests(SimpleTestCase):
@@ -45,6 +47,54 @@ class SystemdSelfCheckTests(SimpleTestCase):
         self.assertEqual(journal_check.message, "pobsync cannot read service logs.")
 
 
+class InstallSelfCheckTests(SimpleTestCase):
+    def test_install_checks_skip_native_paths_in_development_runtime(self) -> None:
+        with override_settings(POBSYNC_ENV_FILE="/missing/pobsync.env"), patch(
+            "pobsync_backend.self_check._native_runtime_available",
+            return_value=False,
+        ):
+            checks = _install_checks()
+
+        self.assertEqual([check.status for check in checks], ["skipped", "skipped", "skipped"])
+        self.assertEqual(checks[0].name, "Environment file")
+        self.assertEqual(checks[1].name, "Service user")
+        self.assertEqual(checks[2].name, "Backup root owner")
+
+    def test_service_user_warns_when_current_user_differs(self) -> None:
+        with override_settings(
+            POBSYNC_ENV_FILE="/etc/pobsync/pobsync.env",
+            POBSYNC_SERVICE_USER="pobsync",
+            POBSYNC_BACKUP_ROOT="/backups",
+        ), patch("pobsync_backend.self_check._native_runtime_available", return_value=True), patch(
+            "pobsync_backend.self_check._env_file_check",
+            return_value=SelfCheck("Environment file", "ok", "/etc/pobsync/pobsync.env"),
+        ), patch(
+            "pobsync_backend.self_check._backup_root_owner_check",
+            return_value=SelfCheck("Backup root owner", "ok", "/backups owner=pobsync"),
+        ), patch(
+            "pobsync_backend.self_check.os.geteuid",
+            return_value=0,
+        ), patch(
+            "pobsync_backend.self_check.pwd.getpwuid",
+        ) as getpwuid:
+            getpwuid.return_value.pw_name = "root"
+            checks = _install_checks()
+
+        service_user_check = next(check for check in checks if check.name == "Service user")
+        self.assertEqual(service_user_check.status, "warning")
+        self.assertIn("expected pobsync", service_user_check.message)
+
+    def test_sqlite_database_check_reports_existing_database(self) -> None:
+        with TemporaryDirectory() as tmp:
+            db_path = Path(tmp) / "pobsync.sqlite3"
+            db_path.write_text("", encoding="utf-8")
+
+            check = _sqlite_database_check(db_path)
+
+        self.assertEqual(check.status, "ok")
+        self.assertEqual(check.name, "SQLite database")
+
+
 class CheckPobsyncInstallCommandTests(SimpleTestCase):
     def test_command_prints_summary_for_successful_checks(self) -> None:
         stdout = StringIO()