[Ava-91]

Phase 8 — verified Restore and recovery

• Records the canonical source-library path in newly created backup manifests, so a restore backup must identify the exact selected library. Backups without identity are rejected for restore rather than guessed.
• Adds read-only preview_restore and gated execute_restore sidecar commands. Preview verifies manifest/file hashes, exact target identity, and a separate safety-backup location; execution revalidates all of these and requires exact RESTORE confirmation bound to a preview token.
• Uses the existing restore_verified_backup implementation, which creates a verified safety backup before replacement and attempts recovery from it if restoration fails. The UI reports success/recovery state and warns when manual recovery may be required; it never auto-retries or auto-resumes.
• Adds a Backups & recovery UI with explicit target selection, full backup/target paths, verification summary, and final confirmation gate.
• Tests use only temporary directories and synthetic WAV files and cover successful restore, safety backup creation, wrong confirmation, token tampering, and mismatched target identity.