fix(restore): harden restore checks and add authelia smoke scaffold

ops/restore-tests/gitea-restore-test.sh

@@ -37,8 +37,14 @@ require_cmd curl
 require_path "$BORG_PASSPHRASE_FILE_DEFAULT"
 require_path "$COMPOSE_FILE"
 
+RESTORE_SUCCESS=0
 cleanup() {
   cleanup_compose "$COMPOSE_FILE"
+  if [ "$RESTORE_SUCCESS" -ne 1 ]; then
+    preserve_on_failure "gitea" "$RESTORE_ROOT"
+    rm -rf "$EXTRACT_DIR"
+    return
+  fi
   if [ "$KEEP_DATA" -ne 1 ]; then
     rm -rf "$DATA_DIR"
   fi
@@ -94,4 +100,5 @@ write_report "$REPORT_FILE" <<EOF
 - Test data was cleaned after success: \`$([ "$KEEP_DATA" -eq 1 ] && echo no || echo yes)\`
 EOF
 
+RESTORE_SUCCESS=1
 echo "Gitea restore test ok -> $REPORT_FILE"