Puts every archived row back, in FK order, in one transaction, and clears the tombstone.

Only a deleted entry restores: a purged one is a 409 (there is nothing left to put back), a restored one is an idempotent no-op. Fail-closed: if any unique constraint would break — an identity link claimed after the tombstone was lifted, a person key, the (entity_id, email) active-unique, a re-used idempotency key — the restore is refused with every offender listed and NOTHING is written. No partial restores, ever.

Derived content is NOT restored because it was never archived: restored payloads come back marked unprocessed, and pendingRebuild names the (entity, source) pairs the embed + conversations pipelines must rebuild. Segment memberships are likewise not restored — the next sweep recomputes and emits enter naturally, which is the honest signal.