feat(523): restore reads the backup tar; python -m scribe.restore brings a fresh instance back

The restore route takes the tar as a raw body beside the JSON download.
scribe/restore.py reads either format, refuses a database that already
has an account (a restore re-creates everything with new ids, so into a
live instance it would duplicate rather than replace), has no size
limit, and says to restart so search indexes rebuild. An integration
test restores a written tar through the real restore_full_backup and
checks every id is remapped. docs/backups.md explains the file, why it
is uncompressed, both destinations, Fabled Archives as the worked
example, and restoring.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/features.md

@@ -127,8 +127,12 @@ Every read and mutation is scoped by owner + direct shares + group shares.
 
 - **Personal export** — download all your notes/tasks as a Markdown ZIP (YAML
   frontmatter) or a JSON array.
-- **Admin backup** — full application backup/restore (format v4) with ID remapping on
+- **Admin backup** — full application backup/restore with ID remapping on
   restore for cross-instance migration.
+- **Scheduled backups** — a daily, dated, uncompressed `.tar` to a folder or an
+  S3-compatible bucket, laid out so a deduplicating tool such as restic stores
+  only what changed; `python -m scribe.restore` brings a fresh instance back
+  from one. See [Backups](backups.md).
 
 ## Progressive Web App
 
@@ -148,7 +152,7 @@ reset, and session invalidation are included. See [SSO / OAuth](sso-oauth.md).
 | Account | Email change, password change, session invalidation |
 | Profile | Per-user profile fields |
 | Integrations | SearXNG status |
-| Data | Personal export; backup / restore (admin) |
+| Data | Personal export; backup / restore and scheduled backups (admin) |
 | API Keys | Create/revoke `fmcp_` keys for the MCP endpoint |
 | Config (admin) | Base URL, SMTP, DB-maintenance schedule |
 | Users (admin) | User list, invite links, registration toggle |