Wire restore into the backup watcher and fix backup timestamps

The api queued .restore-requested but nothing consumed it, so restores silently did nothing. The watcher now services the restore sentinel by running restore.sh, and its instance_data mount is read-write so restore can lay files back down (the manual one-shot stays read-only). Backup stamps use a colon-free UTC form that Date could not parse, so the UI showed raw strings; normalize them before formatting.

scripts/backup/watch.sh

@@ -14,12 +14,17 @@ set -uo pipefail
 
 BACKUPS_ROOT="${SHOPDB_BACKUPS_ROOT:-/backups}"
 SENTINEL="${BACKUPS_ROOT}/.backup-requested"
+RESTORE_SENTINEL="${BACKUPS_ROOT}/.restore-requested"
 INTERVAL="${BACKUP_POLL_SECONDS:-10}"
 
 log() { echo "[backup-watch] $*"; }
 
 mkdir -p "${BACKUPS_ROOT}"
-log "watcher up; polling ${SENTINEL} every ${INTERVAL}s"
+# The api container runs unprivileged and only drops sentinel files here; it
+# cannot write into a root-owned 0755 directory. Make the backups root
+# writable so "Back up now" and "Restore" can queue their sentinels.
+chmod 0777 "${BACKUPS_ROOT}" 2>/dev/null || true
+log "watcher up; polling ${SENTINEL} and ${RESTORE_SENTINEL} every ${INTERVAL}s"
 
 while true; do
 	if [ -f "${SENTINEL}" ]; then
@@ -34,5 +39,18 @@ while true; do
 			rm -f "${SENTINEL}" 2>/dev/null || true
 		fi
 	fi
+	if [ -f "${RESTORE_SENTINEL}" ]; then
+		# The api drops the target set name into the restore sentinel. Read it,
+		# hand it to restore.sh, and clear the request whether it succeeds or
+		# fails so a bad set cannot pin the watcher in a tight retry loop.
+		setname="$(head -n1 "${RESTORE_SENTINEL}" 2>/dev/null | tr -d '\r\n')"
+		log "restore requested - running restore for ${setname}"
+		if /opt/backup/restore.sh "${setname}"; then
+			log "restore completed"
+		else
+			log "restore FAILED - clearing request, awaiting next"
+		fi
+		rm -f "${RESTORE_SENTINEL}" 2>/dev/null || true
+	fi
 	sleep "${INTERVAL}"
 done