test: Phase 2b restore orchestration coverage + nil-safe isDebug

Adds an in-process orchestration test for RestoreFromRecoveryUnit: success path
calls recreate with non-secret env + recovered secrets merged; data-key-missing
path is REFUSED and recreate is never called. Makes Manager.isDebug nil-safe
(behavior-neutral in prod; cfg is always set) so the gate/orchestration are testable.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/backup/backup.go

@@ -594,7 +594,7 @@ func (m *Manager) GetFullStatus(nextDBDump time.Time) *FullBackupStatus {
 
 // isDebug returns true if logging level is "debug".
 func (m *Manager) isDebug() bool {
-	return m.cfg.Logging.Level == "debug"
+	return m.cfg != nil && m.cfg.Logging.Level == "debug"
 }
 
 func dbNames(dbs []DiscoveredDB) string {