fix(auth): address Task 13 deployment review findings

tools/tht/internal/backup/restore.go

@@ -42,10 +42,11 @@ type restoreDependencies struct {
 	verify                   map[string]restoreVerify
 }
 
-// Restore runs the host transaction. Concrete host dependencies are intentionally kept outside
-// the deterministic core so callers cannot bypass its preflight and checkpoint boundaries.
+// Restore runs the host transaction through the same concrete Docker/filesystem boundaries used
+// by backup creation. The injectable core below exists only to make every failure boundary
+// deterministic in tests.
 func Restore(ctx context.Context, installation config.Installation, request RestoreRequest) (RestoreResult, error) {
-	return RestoreResult{}, errors.New("restore host dependencies are unavailable")
+	return restoreWithDependencies(ctx, installation, request, productionRestoreDependencies(installation))
 }
 
 func restoreWithDependencies(ctx context.Context, installation config.Installation, request RestoreRequest, deps restoreDependencies) (result RestoreResult, resultErr error) {
@@ -113,9 +114,6 @@ func restoreWithDependencies(ctx context.Context, installation config.Installati
 		members[member.Name] = member
 	}
 	for _, entry := range preflight.Entries {
-		if entry.Kind == EntryVolume {
-			continue
-		}
 		member := members[entry.Path]
 		if member == nil {
 			return result, fmt.Errorf("verified archive is missing %q", entry.Path)
@@ -125,7 +123,17 @@ func restoreWithDependencies(ctx context.Context, installation config.Installati
 			return result, fmt.Errorf("open verified archive member %q: %w", entry.Path, openErr)
 		}
 		mutated = true
-		restoreErr := deps.restoreFile(ctx, installation, entry, stream)
+		var restoreErr error
+		if entry.Kind == EntryVolume {
+			volume, found := restoreVolumeMetadata(preflight.Manifest, entry.LogicalName)
+			if !found {
+				_ = stream.Close()
+				return result, errors.New("verified volume metadata is incomplete")
+			}
+			restoreErr = deps.restoreVolume(ctx, installation, volume, stream)
+		} else {
+			restoreErr = deps.restoreFile(ctx, installation, entry, stream)
+		}
 		closeErr := stream.Close()
 		if restoreErr != nil {
 			return result, restoreErr
@@ -156,13 +164,25 @@ func restoreWithDependencies(ctx context.Context, installation config.Installati
 	return result, nil
 }
 
+func restoreVolumeMetadata(manifest Manifest, logicalName string) (VolumeMetadata, bool) {
+	if logicalName == "" {
+		return VolumeMetadata{}, false
+	}
+	for _, volume := range manifest.Volumes {
+		if volume.LogicalName == logicalName {
+			return volume, true
+		}
+	}
+	return VolumeMetadata{}, false
+}
+
 // resetAuthenticationState clears browser sessions and pending OIDC transactions without touching
 // installation-global auth.yaml or users.yaml. The command runs as the unprivileged core user so
 // the recreated state root is private to the service on both the local volume and server /data bind.
 func resetAuthenticationState(ctx context.Context, installation config.Installation, runner archiveRunner) error {
 	result, err := runner.Run(ctx, installation.ComposeArgs(
 		"run", "--rm", "--no-deps", "--no-TTY", "--entrypoint", "sh", "core", "-ceu",
-		"rm -rf /data/auth && install -d -m 0700 /data/auth /data/auth/sessions /data/auth/oidc",
+		"find /data/auth -mindepth 1 -maxdepth 1 -exec rm -rf -- {} + && install -d -m 0700 /data/auth /data/auth/sessions /data/auth/oidc && test -z \"$(find /data/auth/sessions /data/auth/oidc -mindepth 1 -print -quit)\"",
 	), nil)
 	if err != nil {
 		return dockerError("reset authentication state", result, err)