Fix rollback data safety and legacy recovery

[frahlg]

What changed

• make pre-update and pre-rollback backups complete and compressed, preserving history and samples
• block incomplete legacy snapshots from restore
• preserve FTW ownership, clear stale SQLite WAL sidecars, health-check restored state, and automatically recover the mandatory safety backup
• recover interrupted rollback jobs after updater restart and support custom /app/data mounts
• harden the legacy Compose migration around ambiguous directories, custom project names, optimizer recreation, and immutable image rollback points
• publish os_list.json on stable version releases and document the permanent Imager URL
• add a Swedish emergency recovery guide for an already affected host

Root cause

The rollback API reused the compact corruption-recovery snapshot. That snapshot intentionally omits the history and sample tables, so restoring it erased recent history. The sidecar also copied files without archive ownership, did not clear stale WAL files, and marked rollback complete without a health check or automatic restoration of the pre-rollback state.

Impact

New rollback points retain the full SQLite database. Legacy incomplete backups remain visible but cannot be restored. A failed restore returns the host to its pre-rollback safety backup instead of leaving FTW offline.

Validation

• make verify
• pre-commit make verify
• pre-push make verify-all including Linux arm64/amd64 and Windows amd64 cross-builds
• npm test (42 tests)
• live v1.3.0/os_list.json and permanent rpi-installer/os_list.json digest comparison