feat: harden firewall policies telemetry and operations

Implement reliable agent apply, telemetry v2, analytics retention, guarded rollouts, enrollment, labels and webhooks. Improve ReUI frontend data safety and bounded list loading, and add Docker smoke, recovery and resource checks. Document local verification and pending native acceptance.

deploy/docker/restore.sh

@@ -0,0 +1,13 @@
+#!/usr/bin/env sh
+set -eu
+image="${1:?Usage: restore.sh IMAGE VOLUME BACKUP_FILE}"
+volume="${2:?VOLUME required}"
+backup="${3:?BACKUP_FILE required}"
+[ -f "$backup" ] || { echo 'Backup file missing' >&2; exit 1; }
+backup="$(cd "$(dirname "$backup")" && pwd)/$(basename "$backup")"
+# Named volumes only. All users must remain stopped for the whole operation.
+docker volume inspect "$volume" >/dev/null
+[ -z "$(docker ps -q --filter "volume=$volume")" ] || { echo 'Stop every container using the volume before restore' >&2; exit 1; }
+docker run --rm --network none --mount "type=volume,src=$volume,dst=/data" \
+  --mount "type=bind,src=$backup,dst=/backup.db,readonly" --entrypoint node \
+  "$image" tools/sqlite-backup.mjs restore /backup.db /data/app.db --offline