feat(client): add selective verified native save restore

[dmuiX]

Summary

Replace the immediate all-title pull action with an explicit, selective and preflight-verified native save restore flow.

User flow

• Verify Server Backups downloads and validates backups without modifying save data.
• Restore Native Saves lists the intersection of installed titles and the server manifest.
• A toggles a title, X selects/clears all, Y continues and B cancels.
• A separate warning screen requires X confirmation before restore.
• Restore is blocked while an application is running.

Safety properties

Before any live Horizon save is opened for replacement, every selected archive must pass:

• successful complete download;
• ZIP open and full decompression/CRC verification;
• no absolute paths, .., backslashes or directories;
• no duplicate archive paths;
• bounded archive/file/path counts and sizes;
• at least one entry under saves/.

If one selected archive fails, the complete operation aborts before changing any live save. Only after the whole preflight succeeds are the already-verified staged archives restored, with per-title success/failure reporting.

The server-manifest intersection avoids treating arbitrary homebrew forwarder IDs as native backups and avoids one HTTP request per forwarder with no backup.

Scope

The restore implementation is app-only. The resident backup code path is unchanged; the bundled version is incremented only so installations can identify the updated app package.

Validation

• clean app and sysmodule build succeeded;
• hardware-tested against 14 installed native titles;
• 13 valid archives restored successfully;
• a 22-byte empty ZIP was rejected before its live save was touched;
• six installed forwarders without server backups were excluded before download.