Add first-run backup recovery and fix large restores

[jnnngs]

What changed

• fixes encrypted restore uploads larger than nginx's ordinary 12 MiB API limit
• allows 512 MiB archives and up to 30 minutes for upload and pg_restore
• adds Restore an existing SUB12 backup to the first-run /setup wizard
• lets the operator browse to the encrypted archive and supply its passphrase without first creating a temporary administrator
• returns to normal sign-in with the restored accounts when complete
• keeps setup restore unavailable once an administrator exists, rejects live sites before reading a large body, and uses the same atomic once-only setup claim as administrator creation
• keeps the entered passphrase request-scoped; restored backup settings remain authoritative
• documents the recovery path and adds regression coverage for proxy limits and the wizard flow

Why

A deleted deployment directory should be recoverable from its encrypted database backup through the normal fresh-install experience. Previously an operator had to finish setup with a throwaway identity before reaching Admin → Backups, and valid archives larger than 12 MiB were rejected by the shipped nginx configuration.

A real 170 MiB production backup exposed both gaps.

Verification

• go vet ./...
• go test ./...
• npm run check
• npm run lint
• TZ=Europe/London npm test -- --run (59 files, 365 tests)
• npm run build
• git diff --check

The unqualified frontend test run has an existing timezone-sensitive date-test failure in this executor; it passes with the project's UK timezone and is unrelated to this change.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, you can upgrade your account or add credits to your account and enable them for code reviews in your settings.