test: boot a panel on a data directory restored from its own backup (P4)

Restore is not a code path in the panel — the operator extracts the archive
onto /data and starts the image — so it had no test. cmd/panel/restore_test.go
now performs that path in process: download a backup from a running panel
through POST /backup (plain and encrypted), unpack it the way tar -xzf does,
and boot a second panel on the result through run()'s own startup order
(CheckRestore, store.Open, newPanel, Start).

Covered: the restored panel shows the domain and journal the archive carried
and finds the DKIM key, sasldb2 and Postfix sender map where its configuration
says they are; the setup link is not reopened by a restore; a session that
predates the backup still works, as the guide documents; an encrypted download
restores identically; a data directory from another version is refused with
both versions named and the manifest kept for the retry.

serveHTTP is split so the composition it performs (newPanel) can be started
without binding a port. No behaviour change.

Closes the optional P4 item in docs/plans/code-review.md, and with it the
"HandleBackup POST untested" gap from the review's test section. CHANGELOG
updated.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Cursor <cursoragent@cursor.com>

docs/plans/code-review.md

@@ -575,8 +575,16 @@ typo; **Sonnet** if e2e docs need a paragraph.
 - [x] Fix e2e L1 fatal string (`50`, not `5`).
 - [x] Pin `coredns` image: tag `1.14.6`, not a digest — the tag is a multi-arch
       manifest and the stand has to come up on arm64 developer machines.
-- [ ] Optional later: backup extract + `CheckRestore` + panel boot (heavy;
-      e2e or integration). Not a P4 blocker.
+- [x] Optional: backup extract + `CheckRestore` + panel boot. Done as an
+      in-process integration test (`cmd/panel/restore_test.go`) rather than
+      e2e, so it runs in `go test ./...`: the archive is downloaded from a
+      running panel through `POST /backup` (which closes the “`HandleBackup`
+      POST untested” gap in §14 as well), unpacked the way `tar -xzf` unpacks
+      it, and a second panel is booted on the result through run()'s own
+      startup order. Also covers the encrypted download, the version-mismatch
+      refusal, that a restore does not reopen the setup link, and that sessions
+      travel in the archive. `serveHTTP` was split so the composition it
+      performs (`newPanel`) can be booted without binding a port.
 
 **Done when:** P0 cannot regress without a red test; e2e L1 message matches
 the override.