feat(migration): add verified import and rollback workflow

apps/api/src/index.ts

@@ -16,7 +16,13 @@ export {
   createCanaryGateway,
 } from './canary-gateway.js';
 export type { CanaryGateway, CanaryGatewayOptions } from './canary-gateway.js';
-export { backupDatabase, restoreDatabase } from './infrastructure/database/backup.js';
+export {
+  activateRestoreCandidate,
+  backupDatabase,
+  prepareRestoreCandidate,
+  runRollbackDrill,
+} from './infrastructure/database/backup.js';
+export type { DatabaseArtifact, RollbackDrillRecord } from './infrastructure/database/backup.js';
 export { openDatabase } from './infrastructure/database/database.js';
 export {
   LegacyImportError,
@@ -29,6 +35,8 @@ export type {
   LegacyImportResult,
   LegacyImportStatus,
 } from './application/legacy-import/legacy-import.js';
+export { runMigrationCli } from './application/legacy-import/migration-cli.js';
+export type { MigrationCliIo } from './application/legacy-import/migration-cli.js';
 export {
   ActivationError,
   activatePendingSecret,