fix(selfhost): add make restore, and stop doctor being shadowable

[L4XB]

Closes #88.

What

make backup existed without a counterpart. The half of the pair that matters
under pressure — at 2am, with a broken deployment — was the half you had to go
find in a runbook. make restore now exists, and make help lists it.

doctor was a target but missing from .PHONY, so a file or directory named
doctor in the repository root would have silently shadowed it.

The interesting part: it asks for the confirmation rather than supplying it

restore.sh refuses to run without --confirm RESTORE. A shortcut that filled
that in automatically would make the destructive operation easier to reach
than the script it wraps — which is the opposite of what a convenience target
should do. The guard is the point.

So the target asks for the same word, and says what is about to be replaced
before it happens:

$ make restore BACKUP=/srv/six/backups/2026-09-14
This replaces the database and every uploaded document with the backup.
Repeat with CONFIRM=RESTORE once you are sure.

Verified by hand

Invocation	Result
make restore	exit 2, names the variables and shows a full example
make restore BACKUP=/tmp/x	exit 2, says what restore destroys
make restore BACKUP=/tmp/x CONFIRM=yes	exit 2, same
make restore BACKUP=/tmp/nope CONFIRM=RESTORE	delegates; restore.sh refuses: "--backup must name an existing, non-symlink absolute directory"
make help	lists restore with its description

The last row is the one that matters: with a correct confirmation the target
does not decide anything itself, it hands over to the script, which applies its
own directory, symlink and checksum checks unchanged.

Tests

test_makefile_shortcuts_use_the_selected_environment_file now also asserts
doctor: and restore: exist and that both appear in .PHONY.

test_make_restore_asks_for_the_confirmation_instead_of_supplying_it is new and
pins the property above. It was checked against its own failure mode:
replacing the CONFIRM test with true makes it fail, so it is testing the
guard rather than the file's existence.

bash deploy/community/test.sh  →  Ran 17 tests, OK

Scope

restore.sh is untouched, as the issue asked. The runbook gains the make
invocation next to the direct one.

[L4XB]

I have read and agree to the SixSentences CLA v1.0.