feat(6848): Settings restore rolls back, from the destination or a file, after a preview

The web restore no longer copies a backup in beside the live data.

- GET /api/admin/restore/sources lists the backups at the backup destination,
  newest first.
- POST /api/admin/restore/preview says what a restore would do, changing
  nothing: fresh or rollback, when the backup was taken, and counts now and
  after per kind. A backup that cannot apply here gets a 409 with the reason.
- POST /api/admin/restore?confirm=rollback runs backup_job.rollback_to_backup:
  safety backup, replace, then search rebuilt in the background.

Each takes ?source=<name> (a backup at the destination) or an upload. The
destination path exists because uploads are held to the request-size limit,
and a real instance's backup is far over it. backup_s3.get_file downloads
from a bucket. backup_destination.list_backups/open_backup only accept names
the scheduled backup writes, so a request cannot reach any other file.

Settings -> Data -> Restore from Backup opens RestoreBackupDialog. The dialog:
1. Pick a backup at the destination or a file.
2. Read the preview.
3. Type "roll back".
4. Run it. The dialog then says where the replaced state was saved, and sends
   the user to sign in again.

Closes #6840. Milestone 582, step 4.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_services_backup_s3.py

@@ -126,3 +126,27 @@ def test_list_reads_contents():
         s3.StoredObject("grimoire-20261011T000000Z.tar", 1200, "2026-10-11T00:00:01.000Z"),
         s3.StoredObject("grimoire-20261012T000000Z.tar", 1300, "2026-10-12T00:00:01.000Z"),
     ]
+
+
+def test_get_streams_the_object_to_disk(tmp_path):
+    seen = {}
+
+    def handler(request):
+        seen["method"], seen["url"] = request.method, str(request.url)
+        seen["sha"] = request.headers["x-amz-content-sha256"]
+        return httpx.Response(200, content=b"y" * 3000)
+
+    out = tmp_path / "b.tar"
+    asyncio.run(s3.get_file(TARGET, "b.tar", out, transport=httpx.MockTransport(handler)))
+    assert seen["method"] == "GET"
+    assert seen["url"] == "http://archives:8081/s3/grimoire/b.tar"
+    assert seen["sha"] == s3.EMPTY_SHA256
+    assert out.read_bytes() == b"y" * 3000
+
+
+def test_a_refused_get_says_so_and_writes_nothing(tmp_path):
+    transport = httpx.MockTransport(lambda r: httpx.Response(403, content=b"<Error><Code>AccessDenied</Code></Error>"))
+    out = tmp_path / "b.tar"
+    with pytest.raises(s3.S3Error, match="b.tar"):
+        asyncio.run(s3.get_file(TARGET, "b.tar", out, transport=transport))
+    assert not out.exists()