feat(6848): Settings restore rolls back, from the destination or a file, after a preview

The web restore no longer copies a backup in beside the live data.

- GET /api/admin/restore/sources lists the backups at the backup destination,
  newest first.
- POST /api/admin/restore/preview says what a restore would do, changing
  nothing: fresh or rollback, when the backup was taken, and counts now and
  after per kind. A backup that cannot apply here gets a 409 with the reason.
- POST /api/admin/restore?confirm=rollback runs backup_job.rollback_to_backup:
  safety backup, replace, then search rebuilt in the background.

Each takes ?source=<name> (a backup at the destination) or an upload. The
destination path exists because uploads are held to the request-size limit,
and a real instance's backup is far over it. backup_s3.get_file downloads
from a bucket. backup_destination.list_backups/open_backup only accept names
the scheduled backup writes, so a request cannot reach any other file.

Settings -> Data -> Restore from Backup opens RestoreBackupDialog. The dialog:
1. Pick a backup at the destination or a file.
2. Read the preview.
3. Type "roll back".
4. Run it. The dialog then says where the replaced state was saved, and sends
   the user to sign in again.

Closes #6840. Milestone 582, step 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_routes_db_maintenance.py

@@ -52,3 +52,9 @@ def test_service_surface_and_allowlist():
 def test_set_admin_setting_exists():
     from grimoire.services.settings import set_admin_setting
     assert callable(set_admin_setting)
+
+
+def test_restore_routes_registered():
+    from grimoire.app import create_app
+    rules = {r.rule for r in create_app().url_map.iter_rules()}
+    assert {"/api/admin/restore", "/api/admin/restore/preview", "/api/admin/restore/sources"} <= rules

tests/test_services_backup_destination.py

@@ -188,3 +188,47 @@ def test_checking_s3_only_lists():
     said = asyncio.run(check_destination(S3, "secret", transport=httpx.MockTransport(handler)))
     assert methods == ["GET", "GET"]
     assert "holds 2 Grimoire backup" in said
+
+
+# ── Restoring from what is already at the destination ──────────────────────
+
+
+def test_a_folder_lists_its_backups_newest_first_and_nothing_else(tmp_path):
+    for name in ("grimoire-20261012T020000Z.tar", "scribe-20261011T020000Z.tar",
+                 "grimoire-20261013T020000Z.tar", "notes.txt", ".grimoire-20261014T020000Z.tar.part"):
+        (tmp_path / name).write_bytes(b"x" * 10)
+    found = asyncio.run(backup_destination.list_backups(BackupConfig(folder_path=str(tmp_path)), None))
+    assert [b.name for b in found] == [
+        "grimoire-20261013T020000Z.tar", "grimoire-20261012T020000Z.tar",
+        "scribe-20261011T020000Z.tar",
+    ]
+    assert found[0].size_bytes == 10
+
+
+def test_a_missing_folder_says_so_when_listing(tmp_path):
+    with pytest.raises(DestinationError, match="isn't there"):
+        asyncio.run(backup_destination.list_backups(
+            BackupConfig(folder_path=str(tmp_path / "absent")), None))
+
+
+def test_opening_a_folder_backup_is_the_file_itself(tmp_path):
+    (tmp_path / "grimoire-20261012T020000Z.tar").write_bytes(b"x")
+    path = asyncio.run(backup_destination.open_backup(
+        BackupConfig(folder_path=str(tmp_path)), None, "grimoire-20261012T020000Z.tar", tmp_path))
+    assert path == tmp_path / "grimoire-20261012T020000Z.tar"
+
+
+@pytest.mark.parametrize("name", [
+    "../etc/passwd", "grimoire-x/../../secret.tar", "secret_key", "/data/secret_key",
+    "grimoire-20261012T020000Z.json",
+])
+def test_only_a_backup_name_can_be_opened(tmp_path, name):
+    with pytest.raises(DestinationError, match="isn't the name of a Grimoire backup"):
+        asyncio.run(backup_destination.open_backup(
+            BackupConfig(folder_path=str(tmp_path)), None, name, tmp_path))
+
+
+def test_a_backup_not_in_the_folder_says_so(tmp_path):
+    with pytest.raises(DestinationError, match="isn't in"):
+        asyncio.run(backup_destination.open_backup(
+            BackupConfig(folder_path=str(tmp_path)), None, "grimoire-20261012T020000Z.tar", tmp_path))

tests/test_services_backup_s3.py

@@ -126,3 +126,27 @@ def test_list_reads_contents():
         s3.StoredObject("grimoire-20261011T000000Z.tar", 1200, "2026-10-11T00:00:01.000Z"),
         s3.StoredObject("grimoire-20261012T000000Z.tar", 1300, "2026-10-12T00:00:01.000Z"),
     ]
+
+
+def test_get_streams_the_object_to_disk(tmp_path):
+    seen = {}
+
+    def handler(request):
+        seen["method"], seen["url"] = request.method, str(request.url)
+        seen["sha"] = request.headers["x-amz-content-sha256"]
+        return httpx.Response(200, content=b"y" * 3000)
+
+    out = tmp_path / "b.tar"
+    asyncio.run(s3.get_file(TARGET, "b.tar", out, transport=httpx.MockTransport(handler)))
+    assert seen["method"] == "GET"
+    assert seen["url"] == "http://archives:8081/s3/grimoire/b.tar"
+    assert seen["sha"] == s3.EMPTY_SHA256
+    assert out.read_bytes() == b"y" * 3000
+
+
+def test_a_refused_get_says_so_and_writes_nothing(tmp_path):
+    transport = httpx.MockTransport(lambda r: httpx.Response(403, content=b"<Error><Code>AccessDenied</Code></Error>"))
+    out = tmp_path / "b.tar"
+    with pytest.raises(s3.S3Error, match="b.tar"):
+        asyncio.run(s3.get_file(TARGET, "b.tar", out, transport=transport))
+    assert not out.exists()