The terminal's failure domains screen runs a restore drill on the newest snapshot with `d` and a confirm, as MCP `restore_drill` does #7298

For: the owner who wants proof a restore works, from the terminal. Never lost means the drill is one key from where its last result is shown.

MCP restore_drill restores the newest snapshot as a drill through snapshotsOf (src/snapshot/service.ts), worded as the Backups page's button. The terminal's failure domains screen (src/tui/screens/domains.ts) shows each domain's last drill but cannot run one.

Done:

• [ ] d, for a forge admin who is a person, asks to confirm, then runs the drill and shows its verdict, failed step and words, as MCP answers them; the domain's row then shows this drill.
• [ ] No store, a failure or a red drill is shown as an answer in words, never as a crash.
• [ ] While it runs, the screen says so and a second d is ignored.
• [ ] A new test/tui-drill.test.ts: a green drill updates the row; no store says so; a non-admin is not offered d.

Files: src/tui/screens/domains.ts, one test. Risk: low; the drill already runs from two doors.