F17: per-app restore now replays the captured .sql DB dump (.sql wins)

The restore paths (RestoreFromRecoveryUnit + the RestoreApp fallback) repopulated
Docker volume tars but NEVER replayed the captured <stack>-<dbtype>.sql dump, so
DB-resident data (e.g. rows in a DB whose data dir is a bind mount) did not come
back — the romm marker round-trip in the audit lost the row.

New appbackup.ImportDump (read-side counterpart to DumpOne) replays a .sql/.sql.gz
into the running DB using the live container's OWN discovered credentials (no env
threading; reuses DiscoveredDB + getMariaDBPassword). backup.reimportDBDumps
orchestrates it AFTER volume restore + stack bring-up, so the logical dump WINS
over any volume-tar copy of the DB (operator-chosen precedence). pg_dump
--clean --if-exists and mariadb-dump (default --add-drop-table) make replay
idempotent; psql ON_ERROR_STOP=1 surfaces real import errors.

Also: volume-restore per-volume failures and DB-import failures now SURFACE (the
restore returns an error) instead of a swallowed WARN, so a failed data restore
cannot read as success.

Tests (restore_db_test.go, injectable discover/import seams): imports when dump+DB
present, failure surfaces, no-dump skips discovery, dump-but-no-matching-DB is a
non-fatal skip. Live DB round-trip to be validated post-deploy.

controller/internal/backup/restore.go

@@ -56,12 +56,17 @@ func (m *Manager) RestoreApp(stackName, snapshotID string) error {
 		m.logger.Printf("[WARN] RESTORE could not stop %s: %v (proceeding anyway)", stackName, err)
 	}
 
+	// F17: surface a data-restore failure instead of swallowing it. We still bring the app back up so it
+	// isn't left dead, but the error is returned at the end so a failed restore can't read as success.
+	var dataErr error
+
 	// Populate Docker volumes from restored tars
 	if m.isDebug() {
 		m.logger.Printf("[DEBUG] RestoreApp: step 2/3 — restoring Docker volumes for %s", stackName)
 	}
 	if err := m.restoreDockerVolumes(stackName, drivePath); err != nil {
-		m.logger.Printf("[WARN] RESTORE volume restore failed for %s: %v (continuing)", stackName, err)
+		m.logger.Printf("[ERROR] RESTORE volume restore failed for %s: %v", stackName, err)
+		dataErr = err
 	}
 
 	// Restart the app
@@ -72,11 +77,23 @@ func (m *Manager) RestoreApp(stackName, snapshotID string) error {
 		m.logger.Printf("[WARN] RESTORE could not restart %s after restore: %v", stackName, err)
 	}
 
+	// F17: replay the captured .sql dump into the now-running DB (the legacy path never did this, so
+	// DB-resident data did not come back). Runs after volume restore so the dump WINS over any tar copy.
+	if _, err := m.reimportDBDumpsCtx(stackName, m.namespaceRoot(drivePath)); err != nil {
+		m.logger.Printf("[ERROR] RESTORE DB re-import failed for %s: %v", stackName, err)
+		if dataErr == nil {
+			dataErr = err
+		}
+	}
+
 	// Verify app started successfully
 	if err := m.waitForHealthy(stackName, 90*time.Second); err != nil {
 		m.logger.Printf("[WARN] [backup] Restore completed but app health check failed: %v", err)
 	}
 
+	if dataErr != nil {
+		return fmt.Errorf("restore of %s completed with data errors: %w", stackName, dataErr)
+	}
 	m.logger.Printf("[INFO] RESTORE completed: stack=%s", stackName)
 	return nil
 }
@@ -93,6 +110,7 @@ func (m *Manager) restoreDockerVolumes(stackName, drivePath string) error {
 	}
 
 	var restored int
+	var failed []string
 	for _, entry := range entries {
 		if entry.IsDir() || !strings.HasSuffix(entry.Name(), ".tar") {
 			continue
@@ -106,7 +124,8 @@ func (m *Manager) restoreDockerVolumes(stackName, drivePath string) error {
 
 		// Create fresh volume
 		if out, err := exec.Command("docker", "volume", "create", volName).CombinedOutput(); err != nil {
-			m.logger.Printf("[WARN] [backup] Failed to create volume %s: %s — %v", volName, strings.TrimSpace(string(out)), err)
+			m.logger.Printf("[ERROR] [backup] Failed to create volume %s: %s — %v", volName, strings.TrimSpace(string(out)), err)
+			failed = append(failed, volName)
 			continue
 		}
 
@@ -120,7 +139,8 @@ func (m *Manager) restoreDockerVolumes(stackName, drivePath string) error {
 		cancel()
 
 		if err != nil {
-			m.logger.Printf("[WARN] [backup] Failed to populate volume %s: %s — %v", volName, strings.TrimSpace(string(out)), err)
+			m.logger.Printf("[ERROR] [backup] Failed to populate volume %s: %s — %v", volName, strings.TrimSpace(string(out)), err)
+			failed = append(failed, volName)
 			continue
 		}
 
@@ -133,6 +153,11 @@ func (m *Manager) restoreDockerVolumes(stackName, drivePath string) error {
 	if restored > 0 {
 		m.logger.Printf("[INFO] [backup] Restored %d Docker volume(s) for %s", restored, stackName)
 	}
+	// F17: a per-volume failure used to be a swallowed WARN; surface it so the restore is reported as
+	// failed rather than silently partial.
+	if len(failed) > 0 {
+		return fmt.Errorf("failed to restore %d volume(s): %v", len(failed), failed)
+	}
 	return nil
 }