feat(migration): add verified import and rollback workflow

apps/api/src/infrastructure/database/database.test.ts

@@ -277,6 +277,24 @@ describe('database migrations', () => {
 });
 
 describe('database backup and restore', () => {
+  it('honours a canonical restore marker when opening through a symlinked parent alias', async () => {
+    const directory = await temporaryDirectory();
+    const realDirectory = join(directory, 'real');
+    const aliasDirectory = join(directory, 'alias');
+    await mkdir(realDirectory);
+    const databasePath = join(realDirectory, 'app.sqlite');
+    const database = openDatabase(databasePath);
+    migrateDatabase(database);
+    database.close();
+    await writeFile(
+      `${databasePath}.restore-in-progress`,
+      JSON.stringify({ version: 1, quarantinedSidecars: [] }),
+    );
+    await symlink(realDirectory, aliasDirectory);
+
+    expect(() => openDatabase(join(aliasDirectory, 'app.sqlite'))).toThrow(/restore|recovery/i);
+  });
+
   it('refuses restore while a managed live connection is open', async () => {
     const directory = await temporaryDirectory();
     const databasePath = join(directory, 'app.sqlite');