Restore a point into a new volume

Restores a point into a volume Sencho creates. The source volume need not exist any more. The target name must be a name Docker accepts for a volume (anything else answers 400 before an operation is recorded), must not exist, must not name one of Sencho's own volumes, must not start with sencho-recovery-, and needs the same access that changing a stack does when it starts with a known stack's name plus an underscore. Sencho records a restore intent, creates the target with that intent's label, proves it created it, restores with verification, and on failure removes only its own unused target. Extended-attribute-only failures end partial with errorClass: attributes_not_restored and an xattrWarnings count, and the volume is kept. A point in a replaced repository answers 503 repository_unavailable with reason repository_replaced. Only a Full Admin API token may call it; any other scope is refused with 403 SCOPE_DENIED.