test: boot a panel on a data directory restored from its own backup (P4)

Restore is not a code path in the panel — the operator extracts the archive
onto /data and starts the image — so it had no test. cmd/panel/restore_test.go
now performs that path in process: download a backup from a running panel
through POST /backup (plain and encrypted), unpack it the way tar -xzf does,
and boot a second panel on the result through run()'s own startup order
(CheckRestore, store.Open, newPanel, Start).

Covered: the restored panel shows the domain and journal the archive carried
and finds the DKIM key, sasldb2 and Postfix sender map where its configuration
says they are; the setup link is not reopened by a restore; a session that
predates the backup still works, as the guide documents; an encrypted download
restores identically; a data directory from another version is refused with
both versions named and the manifest kept for the retry.

serveHTTP is split so the composition it performs (newPanel) can be started
without binding a port. No behaviour change.

Closes the optional P4 item in docs/plans/code-review.md, and with it the
"HandleBackup POST untested" gap from the review's test section. CHANGELOG
updated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

CHANGELOG.md

@@ -64,6 +64,19 @@ Format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/); version
   reload) is checked to answer a domain administrator — and a request with no
   principal — with 404, the check that would have caught the send-log leak.
 
+- test: restore is covered as the operator performs it, in process. A backup is
+  downloaded from a running panel through `POST /backup` (plain and encrypted),
+  unpacked the way `tar -xzf` unpacks it onto the `/data` bind mount, and a
+  second panel is booted on the result through the startup order the panel
+  itself uses — version guard, database, services, HTTP application. The
+  restored panel shows the domain and journal the archive carried, finds the
+  DKIM key, SASL database and Postfix sender map where its configuration says
+  they are, does not reopen the one-time setup link, and still honours a
+  session that predates the backup. A data directory left by another version is
+  refused with both versions named and the manifest kept. `serveHTTP` is split
+  in two so that composition can be started without binding a port; no
+  behaviour change.
+
 - test (e2e): the CoreDNS image is pinned to `1.14.6` instead of `latest`, so
   the release gate cannot change under a commit between two runs. The level-1
   rate-limit failure message quoted `RATE_LIMIT_MESSAGES_PER_IP=5` while the