Recovery, part 1: a one-page notecard whose commands the drill runs, and a Backups line that says whether the forge is recoverable now #1986

Split from #1147 (the owner's ask: recovery that can be printed on a notecard and kept in a safe). Pulls #1872 and #1941 had most of this done; this part is only that.

Done looks like:

• [ ] One runbook, not two: docs/RESTORE.md (already on main, with test/restore-card.test.ts) becomes the printable page: the five commands that bring a forge back from nothing (install bun and git, set the variables, restore the newest snapshot, start the forge, point DNS), and where the passphrase and bucket credentials live.
• [ ] src/snapshot/drill.ts restores the newest snapshot into an empty directory, boots nothing it does not need, and returns counts (repositories, users, issues, pulls, apps) and whether one sealed value opens with the passphrase. A failed listing is an error, not a note.
• [ ] The Backups page says in one line: store reachable, newest snapshot age, key carried, last drill result.
• [ ] Tests: the drill returns the counts of a seeded snapshot; the test reads the doc and checks its commands are the ones the drill runs.

Start from today's main, at or after 91fd5057. Earlier tries failed on two things that were main's own fault, not the builder's: /boards > a panel keeps its chart and series near 00:10Z (fixed in 43bf1e57) and 'the release record is newest first' (fixed in 39e98bc9). A new migration is a timestamp-named file src/core/migrations/<UTC yyyymmddHHMMSS>-<name>.ts, never a number; do not hand-edit src/core/releases.json. Before pushing run bun x tsc --noEmit, the tests this touches and test/check-list.test.ts; name every new test file in GATE in scripts/gate.ts in the same commit. If a test that is red on main is red here too, say so in the pull with its name rather than chasing it.

Parked by the crew: the check stayed red through 2 automatic tries (pull #1990 closed). Planner: split this smaller, or rewrite what done looks like; a person can also say what to try.

Parked by the crew: the preview's deploy failed and the decider saw no point in another try (pull #2098 closed).

Parked twice since a person last spoke here, so it is the planner's now. Every reason:

1. the check stayed red through 2 automatic tries (pull #1990 closed)
2. the preview's deploy failed and the decider saw no point in another try (pull #2098 closed)

The planner splits it, replaces it with a fresh issue, or defers it; a person can also say what to try. Nothing starts here until then, and the board lists it.

Split. Most of this is on main already: the card in docs/RESTORE.md is tested by test/restore-card.test.ts (#1184), the drill runs (src/snapshot/drill.ts), and its row and line are on Backups (#1668, #1804). What was left is now two small issues: #2145 (the drill counts users, pulls and apps, and a failed count is red) and #2146 (one line on Backups: "Recoverable now" or the first thing in the way). #1988 now waits on #2145.