feat(backup): C2 Part 1 — RestoreTier2Files: in-place, additive-only class-C file restore engine

Closes the engine half of drill finding F2: user files under appdata/<stack>
had no customer recovery path (operator copy-back only).

- RestoreTier2Files(stack): single-flight with backup/restore; ALL refusals
  before any stop (no Tier-2 record / LastRun empty / copy dir absent →
  "nincs másodlagos fájlmásolat"; Tier-2 drive disconnected; live drive
  disconnected/decommissioned — Hungarian, flash-ready); source is the
  RECORDED CrossDriveBackup.DestinationPath (never a fresh selectTier2Target);
  stop → copy → start → waitForHealthy; copy/restart errors surface (F17).
- rsyncRestoreMissing: rsyncMirror's exec shape with the OPPOSITE-direction
  flags: -a --ignore-existing --itemize-changes — existing live files are
  never overwritten, nothing is ever deleted (the --delete trap this task
  exists to avoid). Count = ">f" itemize lines (pure countRestoredFiles).
- restoreFilesCopier seam so orchestration tests never shell out; the one
  FS-level test of the real rsync is LookPath-guarded (runs on the Linux
  build server + live validation).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/backup/backup.go

@@ -50,6 +50,10 @@ type Manager struct {
 	// NEVER consulted for data-keys — the fail-closed gate refuses those before generation runs.
 	generateSecret func(stackName, envVar string) (string, bool)
 
+	// restoreFilesCopier (C2) — the Tier-2 in-place file-restore copy seam, overridable in tests so
+	// the orchestration never shells out. Nil → the real rsyncRestoreMissing (additive-only).
+	restoreFilesCopier func(src, dst string) (filesRestored int, err error)
+
 	// migrationRunning, if set, reports whether a data migration is in progress. The scheduled
 	// backup paths skip when it returns true (Change 3 — backup ↔ migration mutual exclusion), so a
 	// nightly dump/Tier-2 can't race a migration copy/cleanup on the same drive.