feat(6848): Settings restore rolls back, from the destination or a file, after a preview

The web restore no longer copies a backup in beside the live data.

- GET /api/admin/restore/sources lists the backups at the backup destination,
  newest first.
- POST /api/admin/restore/preview says what a restore would do, changing
  nothing: fresh or rollback, when the backup was taken, and counts now and
  after per kind. A backup that cannot apply here gets a 409 with the reason.
- POST /api/admin/restore?confirm=rollback runs backup_job.rollback_to_backup:
  safety backup, replace, then search rebuilt in the background.

Each takes ?source=<name> (a backup at the destination) or an upload. The
destination path exists because uploads are held to the request-size limit,
and a real instance's backup is far over it. backup_s3.get_file downloads
from a bucket. backup_destination.list_backups/open_backup only accept names
the scheduled backup writes, so a request cannot reach any other file.

Settings -> Data -> Restore from Backup opens RestoreBackupDialog. The dialog:
1. Pick a backup at the destination or a file.
2. Read the preview.
3. Type "roll back".
4. Run it. The dialog then says where the replaced state was saved, and sends
   the user to sign in again.

Closes #6840. Milestone 582, step 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_routes_db_maintenance.py

@@ -52,3 +52,9 @@ def test_service_surface_and_allowlist():
 def test_set_admin_setting_exists():
     from grimoire.services.settings import set_admin_setting
     assert callable(set_admin_setting)
+
+
+def test_restore_routes_registered():
+    from grimoire.app import create_app
+    rules = {r.rule for r in create_app().url_map.iter_rules()}
+    assert {"/api/admin/restore", "/api/admin/restore/preview", "/api/admin/restore/sources"} <= rules