test(6849): the restore command previews without --yes and rolls back from the tar with it

Two integration tests in test_integration_backup_rollback.py drive
grimoire.restore.run on the scheduled backup's tar, written from a full
export of this instance:
- without --yes it exits 4 and nothing changes;
- with --yes it takes the safety backup, then puts back the edited and the
  deleted task and removes the new one.

The file-restore test that expected a refusal "because the database has
accounts" now names the reason it actually refuses: on a live instance, a
backup that records no instance id can't be rolled back to.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_integration_backup_rollback.py

@@ -4,6 +4,7 @@ The lane shares one database, so every test here takes its backup of the
 whole store, changes its own rows, and rolls back to that backup: what it
 puts back is exactly what was there when it started.
 """
+from datetime import datetime, timezone
 from unittest.mock import AsyncMock, patch
 
 import pytest
@@ -14,8 +15,10 @@ from grimoire.models import async_session
 from grimoire.models.note import Note
 from grimoire.models.project import Project
 from grimoire.models.user import User
-from grimoire.services import backup
+from grimoire.restore import run
+from grimoire.services import backup, backup_job
 from grimoire.services.api_keys import create_api_key, lookup_key
+from grimoire.services.backup_file import write_archive
 from grimoire.services.instance import adopt_instance_id, get_instance_id
 from tests.helpers import ensure_user
 
@@ -176,3 +179,36 @@ async def test_a_fresh_instance_adopts_the_backups_instance_id(seeded):
         async with async_session() as s:
             await adopt_instance_id(s, own)
             await s.commit()
+
+
+async def test_the_command_only_previews_without_yes(seeded, tmp_path):
+    ids, payload, _ = seeded
+    path = write_archive(payload, tmp_path, datetime.now(timezone.utc), app_version="test")
+    new_id = await _change_everything(ids)
+
+    assert await run(path) == 4
+
+    async with async_session() as s:
+        assert (await s.get(Note, ids["kept"])).title == "after"
+        assert await s.get(Note, new_id) is not None
+    await backup.replace_from_backup(payload)
+
+
+async def test_the_command_rolls_back_from_the_tar_with_yes(seeded, tmp_path):
+    """The scheduled backup's own file, read back through the command: the
+    whole store returns to it, after the safety backup is taken."""
+    ids, payload, _ = seeded
+    path = write_archive(payload, tmp_path, datetime.now(timezone.utc), app_version="test")
+    new_id = await _change_everything(ids)
+    saved = {"file": "grimoire-safety.tar", "size_bytes": 1, "where": str(tmp_path)}
+
+    with patch.object(backup_job, "save_state_before_restore",
+                      AsyncMock(return_value=saved)) as save:
+        assert await run(path, yes=True) == 0
+
+    save.assert_awaited_once()
+    async with async_session() as s:
+        kept = await s.get(Note, ids["kept"])
+        assert (kept.title, kept.body) == ("before", "as backed up")
+        assert await s.get(Note, ids["doomed"]) is not None
+        assert await s.get(Note, new_id) is None