feat: add single-database restore mode to restore.sh

tests/test_restore.sh

@@ -91,12 +91,70 @@ test_file_restore_dry_run_makes_no_borg_call() {
     rm -rf "$mockdir" "$dest"
 }
 
+test_db_restore_with_yes_runs_full_sequence() {
+    local mockdir out bashenv
+    mockdir="$(mktemp -d)"
+    setup_mock_bin "$mockdir"
+    echo "rootpass" > "$mockdir/rootpw"
+    # This host may have a real `docker` CLI in one of the system dirs that
+    # restore.sh's hardened PATH prepends (e.g. /usr/local/bin), which would
+    # shadow the mock and make a real (unreachable) docker daemon get called
+    # instead. A BASH_ENV-sourced function takes precedence over PATH lookup
+    # regardless of PATH ordering, so force `docker` to the mock that way.
+    bashenv="$mockdir/bash_env.sh"
+    cat > "$bashenv" <<EOF
+docker() { "$mockdir/docker" "\$@"; }
+EOF
+    out="$(PATH="$mockdir:$PATH" ROOT_PASSWORD_FILE="$mockdir/rootpw" BASH_ENV="$bashenv" bash "$RESTORE" db shopdb --yes </dev/null)"
+    assert_contains "$out" "Database 'shopdb' restored from" "db mode reports success"
+    if grep -q "CREATE DATABASE IF NOT EXISTS" "$mockdir/mock.log"; then
+        echo "PASS: db mode issued CREATE DATABASE"
+    else
+        echo "FAIL: db mode did not issue CREATE DATABASE"
+        FAILURES=$((FAILURES + 1))
+    fi
+    rm -rf "$mockdir"
+}
+
+test_db_restore_dry_run_skips_confirmation_and_calls() {
+    local mockdir out
+    mockdir="$(mktemp -d)"
+    setup_mock_bin "$mockdir"
+    out="$(PATH="$mockdir:$PATH" bash "$RESTORE" db shopdb --dry-run </dev/null)"
+    assert_contains "$out" "DRY-RUN" "db dry-run prints DRY-RUN plan"
+    # cmd_db calls resolve_archive() (a borg list call) before checking DRY_RUN,
+    # same as cmd_file does, so mock.log legitimately gets a "borg list" entry.
+    # What must NOT happen in dry-run is any docker/mysql/mariadb interaction.
+    if grep -qE "^(docker|mysql|mariadb)" "$mockdir/mock.log"; then
+        echo "FAIL: dry-run invoked a docker/db-client mock binary"
+        FAILURES=$((FAILURES + 1))
+    else
+        echo "PASS: dry-run made no docker/db-client calls"
+    fi
+    rm -rf "$mockdir"
+}
+
+test_db_restore_aborts_on_wrong_confirmation() {
+    local mockdir rc
+    mockdir="$(mktemp -d)"
+    setup_mock_bin "$mockdir"
+    set +e
+    echo "wrongname" | PATH="$mockdir:$PATH" bash "$RESTORE" db shopdb >/dev/null 2>&1
+    rc=$?
+    set -e
+    assert_eq "1" "$rc" "db mode aborts on mismatched confirmation"
+    rm -rf "$mockdir"
+}
+
 test_help_exits_zero
 test_no_args_exits_one
 test_unknown_command_exits_one
 test_list_archives
 test_file_restore_extracts_to_dest
 test_file_restore_dry_run_makes_no_borg_call
+test_db_restore_with_yes_runs_full_sequence
+test_db_restore_dry_run_skips_confirmation_and_calls
+test_db_restore_aborts_on_wrong_confirmation
 
 echo "-----"
 if [[ "$FAILURES" -gt 0 ]]; then