feat(6848): Settings restore rolls back, from the destination or a file, after a preview

The web restore no longer copies a backup in beside the live data.

- GET /api/admin/restore/sources lists the backups at the backup destination,
  newest first.
- POST /api/admin/restore/preview says what a restore would do, changing
  nothing: fresh or rollback, when the backup was taken, and counts now and
  after per kind. A backup that cannot apply here gets a 409 with the reason.
- POST /api/admin/restore?confirm=rollback runs backup_job.rollback_to_backup:
  safety backup, replace, then search rebuilt in the background.

Each takes ?source=<name> (a backup at the destination) or an upload. The
destination path exists because uploads are held to the request-size limit,
and a real instance's backup is far over it. backup_s3.get_file downloads
from a bucket. backup_destination.list_backups/open_backup only accept names
the scheduled backup writes, so a request cannot reach any other file.

Settings -> Data -> Restore from Backup opens RestoreBackupDialog. The dialog:
1. Pick a backup at the destination or a file.
2. Read the preview.
3. Type "roll back".
4. Run it. The dialog then says where the replaced state was saved, and sends
   the user to sign in again.

Closes #6840. Milestone 582, step 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_services_backup_destination.py

@@ -188,3 +188,47 @@ def test_checking_s3_only_lists():
     said = asyncio.run(check_destination(S3, "secret", transport=httpx.MockTransport(handler)))
     assert methods == ["GET", "GET"]
     assert "holds 2 Grimoire backup" in said
+
+
+# ── Restoring from what is already at the destination ──────────────────────
+
+
+def test_a_folder_lists_its_backups_newest_first_and_nothing_else(tmp_path):
+    for name in ("grimoire-20261012T020000Z.tar", "scribe-20261011T020000Z.tar",
+                 "grimoire-20261013T020000Z.tar", "notes.txt", ".grimoire-20261014T020000Z.tar.part"):
+        (tmp_path / name).write_bytes(b"x" * 10)
+    found = asyncio.run(backup_destination.list_backups(BackupConfig(folder_path=str(tmp_path)), None))
+    assert [b.name for b in found] == [
+        "grimoire-20261013T020000Z.tar", "grimoire-20261012T020000Z.tar",
+        "scribe-20261011T020000Z.tar",
+    ]
+    assert found[0].size_bytes == 10
+
+
+def test_a_missing_folder_says_so_when_listing(tmp_path):
+    with pytest.raises(DestinationError, match="isn't there"):
+        asyncio.run(backup_destination.list_backups(
+            BackupConfig(folder_path=str(tmp_path / "absent")), None))
+
+
+def test_opening_a_folder_backup_is_the_file_itself(tmp_path):
+    (tmp_path / "grimoire-20261012T020000Z.tar").write_bytes(b"x")
+    path = asyncio.run(backup_destination.open_backup(
+        BackupConfig(folder_path=str(tmp_path)), None, "grimoire-20261012T020000Z.tar", tmp_path))
+    assert path == tmp_path / "grimoire-20261012T020000Z.tar"
+
+
+@pytest.mark.parametrize("name", [
+    "../etc/passwd", "grimoire-x/../../secret.tar", "secret_key", "/data/secret_key",
+    "grimoire-20261012T020000Z.json",
+])
+def test_only_a_backup_name_can_be_opened(tmp_path, name):
+    with pytest.raises(DestinationError, match="isn't the name of a Grimoire backup"):
+        asyncio.run(backup_destination.open_backup(
+            BackupConfig(folder_path=str(tmp_path)), None, name, tmp_path))
+
+
+def test_a_backup_not_in_the_folder_says_so(tmp_path):
+    with pytest.raises(DestinationError, match="isn't in"):
+        asyncio.run(backup_destination.open_backup(
+            BackupConfig(folder_path=str(tmp_path)), None, "grimoire-20261012T020000Z.tar", tmp_path))