restore: pick a dump, pick a database, say yes

A pg_dump carries CREATE TABLE, so it cannot be layered onto a database that
already has the schema — it fails on every object. The only honest restore
empties the target first, and that is not a detail to bury behind a button. So
choosing a destination and confirming are two separate clicks, and the second
names what it is about to destroy.

`confirm` is required by the function, not merely by the panel, so no code path
can reach a restore by accident.

The file is matched against what listDumps actually found in the backup
directory rather than taken as given. There is no path to traverse out of and no
way to point psql at a file this module did not write: an unknown name is
refused before anything is opened, rather than sanitised and hoped about.

Emptied with DROP SCHEMA public CASCADE through psql, not by dropping the
DATABASE — that would need a connection to another one, fail while anything is
attached, and lose whatever was granted on it. Replacing the schema does the
same job to the part that matters.

psql rather than pg_restore, because these are plain-SQL dumps, which is what
pg_dump writes without -F c.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

api/router.ts

@@ -9,7 +9,7 @@ import { readSync, startSync } from './sync';
 import { readRuns } from './ledger';
 import { reconcile } from './derive';
 import { createDatabases, pushSchema, readDatabases } from './databases';
-import { readBackups, runBackup, saveBackups, schedule, testDestination } from './backups';
+import { readBackups, restoreBackup, runBackup, saveBackups, schedule, testDestination } from './backups';
 import { join } from 'node:path';
 import { fofosRequest, FofosError, probe, type FofosResponse } from './fofos-client';
 
@@ -368,6 +368,30 @@ router.post('/_config/backups/test', async (ctx) => {
   }
 });
 
+/**
+ * Load a dump back into one of the databases.
+ *
+ * `confirm` is required by the function behind this, not merely by the panel. A restore empties the
+ * target first — a pg_dump carries CREATE TABLE and cannot be layered onto a database that already has
+ * the schema — and that is not something any code path should be able to reach by accident.
+ */
+router.post('/_config/backups/restore', async (ctx) => {
+  const { file, target, confirm } = (ctx.get('body') ?? {}) as {
+    file?: string;
+    target?: string;
+    confirm?: boolean;
+  };
+  if (target !== 'production' && target !== 'development') {
+    return ctx.json({ error: 'Target must be production or development.' }, 400);
+  }
+  try {
+    const result = await restoreBackup({ file: file ?? '', target, confirm: confirm === true });
+    return ctx.json({ ...result, status: await readDatabases() }, result.ok ? 200 : 400);
+  } catch (error) {
+    return ctx.json({ error: (error as Error).message }, 400);
+  }
+});
+
 router.post('/_config/backups/run', async (ctx) => {
   try {
     const result = await runBackup();