feat(node): one-click "Restore original wallet" after a daemon auto-recovery

Adds the restore action to the wallet-auto-recovery warning: undo the daemon's
salvage by swapping the untouched original (wallet.<ts>.bak) back over the
salvaged copy and clearing the stale BDB env that triggered the false recovery,
then restarting. Modeled on beginAdoptSeedWallet (stop daemon → file ops →
restart on a worker; result pumped to the main thread for notifications).

Safety (fund-adjacent file ops on a real wallet — copy/rename only, never delete
user data):
- picks the newest wallet.<unixtime>.bak via the pure, unit-tested
  newestWalletSalvageBak(); aborts if none.
- verifies the .bak is a real Berkeley DB (probeWalletFile) before touching
  anything — won't overwrite a working wallet with a bad backup.
- stops the daemon first (stopDaemonForWalletSwitch) so wallet.dat is released.
- moves the salvaged copy aside to wallet.dat.salvaged-<ts>.dat (kept), COPIES
  the .bak into place (the .bak stays), moves database/ aside to
  database.pre-restore-<ts>.bak (kept), and drops only the transient __db.*
  BDB region files. Rolls back the move if the copy fails.
- relaunches the node even on failure so it's never left down.

The warning dialog now offers Restore original wallet / Open data folder /
Keep salvaged copy. Full-node only; lite-safe. Build clean, suite green (1/1).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/app.h

@@ -906,6 +906,12 @@ private:
     bool wallet_auto_recovered_ = false;         // a salvage happened this session
     bool wallet_auto_recovered_warned_ = false;  // guard: only surface it once per session
     bool show_wallet_recovered_dialog_ = false;  // auto-shown warning dialog
+    // "Restore original wallet" background op: worker sets these under the mutex, pumpWalletRestore()
+    // (main thread) shows the result. 0 = success, 1 = warning, 2 = error.
+    std::mutex wallet_restore_mutex_;
+    bool wallet_restore_done_ = false;
+    int  wallet_restore_severity_ = 0;
+    std::string wallet_restore_msg_;
     // Live progress for the switch modal: it stays open from confirm through stop → wait-for-exit → start →
     // reconnect and auto-closes when the new node connects (onConnected). Phase is worker-updated;
     // dialog_open_ gates rendering — both atomic since onConnected/the worker may run off the main thread.
@@ -1338,6 +1344,8 @@ private:
     void renderBlockDbReindexDialog();    // offer to rebuild an unreadable block database (-reindex)
     void reindexBlockDatabase();          // restart the daemon with -reindex to rebuild the block DB
     void renderWalletRecoveredDialog();   // warn that the node auto-recovered/salvaged wallet.dat
+    void restoreOriginalWallet();         // swap the wallet.<ts>.bak back over the salvaged copy + restart
+    void pumpWalletRestore();             // main-thread: surface the restore op's result
     void processDeferredEncryption();
 
     // Private methods - connection