Add checksum validation for archived media

docs/ops/media-storage-spec.md

@@ -59,6 +59,7 @@ This document explains how customer photo uploads move through the Fotospiel pla
 | Security queue | `.env SECURITY_SCAN_QUEUE` & `config/security.php` | Defaults to `media-security`. |
 | Archive scheduling | `config/storage-monitor.php['archive']` | Controls grace days, chunk size, locking, and dispatch caps. |
 | Queue health alerts | `config/storage-monitor.php['queue_health']` | Warning/critical thresholds for `media-storage` and `media-security` queues. |
+| Checksum alerts | `config/storage-monitor.php['checksum_validation']` | Enables checksum verification alerts and thresholding window. |
 | Container volumes | `docker-compose.yml` | `app`, workers, and scheduler share the `app-code` volume so `/var/www/html/storage` is common. |
 
 ## Operational Checklist
@@ -72,6 +73,7 @@ This document explains how customer photo uploads move through the Fotospiel pla
   - Watch `storage:monitor` output (email or logs) for capacity warnings on hot disks.
   - Use Horizon or Redis metrics to verify `media-storage` queue depth; thresholds live in `config/storage-monitor.php`.
   - Review `/var/www/html/storage/logs/storage-jobs.log` (if configured) for archival failures.
+  - Checksum mismatches (hot→archive) are flagged by `storage:monitor` using `checksum_validation` thresholds.
   - Ensure `media-security` queue stays below critical thresholds so uploads aren’t blocked awaiting security scans.
 
 - **Troubleshooting uploads**