fix(restore): harden restore checks and add authelia smoke scaffold

ops/restore-tests/immich-restore-test.sh

@@ -64,8 +64,14 @@ require_cmd curl
 require_path "$BORG_PASSPHRASE_FILE_DEFAULT"
 require_path "$COMPOSE_FILE"
 
+RESTORE_SUCCESS=0
 cleanup() {
   cleanup_compose "$COMPOSE_FILE"
+  if [ "$RESTORE_SUCCESS" -ne 1 ]; then
+    preserve_on_failure "immich" "$RESTORE_ROOT"
+    rm -rf "$EXTRACT_DIR"
+    return
+  fi
   if [ "$KEEP_DATA" -ne 1 ]; then
     rm -rf "$RESTORE_ROOT"
   fi
@@ -244,4 +250,5 @@ write_report "$REPORT_FILE" <<EOF
 - Restore-Quelle Dump: \`local/borg-dumps/latest/immich.dump\` aus aktuellem Borg-Archiv.
 EOF
 
+RESTORE_SUCCESS=1
 echo "Immich restore test ok -> $REPORT_FILE"