Wire restore into the backup watcher and fix backup timestamps

The api queued .restore-requested but nothing consumed it, so restores silently did nothing. The watcher now services the restore sentinel by running restore.sh, and its instance_data mount is read-write so restore can lay files back down (the manual one-shot stays read-only). Backup stamps use a colon-free UTC form that Date could not parse, so the UI showed raw strings; normalize them before formatting.

docker-compose.backup.yml

@@ -110,9 +110,11 @@ services:
       SHOPDB_BACKUPS_ROOT: /backups
       BACKUP_POLL_SECONDS: ${BACKUP_POLL_SECONDS:-10}
     volumes:
-      # The files half of the backup scope, read-only: we never mutate the live
-      # instance tree from the backup path.
-      - instance_data:/app/instance:ro
+      # The watcher services both backup (read) and restore (write) requests, so
+      # the instance tree is mounted read-write here. Restore has to lay the
+      # files half of a set back down next to the DB rows that reference it; the
+      # backup half still only ever reads. The manual one-shot below stays :ro.
+      - instance_data:/app/instance
       # Alembic chain, read-only, so the manifest can stamp the schema revision
       # the running code is at.
       - ./migrations:/app/migrations:ro