An admin runs a restore drill on demand: the newest snapshot restored into an empty directory, opened, counted, and its verdict on the Backups page #1568

Replaces #1182, made smaller: on demand first; the weekly schedule and the push come in #1183 and #1481.

Done looks like:

• [ ] src/snapshot/drill.ts: runDrill() fetches the newest snapshot, calls restoreSnapshot (src/snapshot/restore.ts) into a fresh directory under FORGE_APP_DATA, opens the database read-only, counts repositories and issues, unseals one sealed value, and deletes the directory in a finally; a timeout (10 min) ends a hang as a red verdict naming the step.
• [ ] Each drill is one row (when, snapshot id, duration, counts, verdict, failing step); the Backups page shows the last one in one line and a "Run a drill" button (admin, same-origin checked).
• [ ] test/snapshot-drill.test.ts, added to GATE in scripts/gate.ts (both earlier pulls went red elsewhere; start from a green main): a snapshot of a seeded forge drills green with the right counts; a corrupt snapshot drills red naming the step; the temp directory is gone afterwards.

Parked by the crew: the check stayed red through 2 automatic tries (pull #1580 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the check failed ("report mode is loud to admins, and to nobody else > reported: the Capacity page says it once, as a note; vitals do not") and the decider saw no point in another try (pull #1650 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #1580 closed)
2. the check failed ("report mode is loud to admins, and to nobody else > reported: the Capacity page says it once, as a note; vitals do not") and the decider saw no point in another try (pull #1650 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split. Both tries went red: #1580 stayed red through its automatic tries, and #1650 went red on a report-mode test it does not touch. Module first, page second: #1667 runDrill() and its test, then #1668 the drill row, the Backups line and the admin button. #1183 and #1481 now wait for #1667, and #1195 and #1147 for #1668.