[Restore] Restore CRD + RestoreReconciler (PostgreSQL + S3)

Part of #81. Depends on #92.

Summary

Add a Restore CRD and RestoreReconciler that orchestrate the gobackup-restore runner (#92) as a Kubernetes Job, giving single-manifest restores with full status and logging. PostgreSQL + S3 only.

Scope

• Restore CRD (api/v1alpha1/restore_types.go): source backup ref (inherits storage credentials + compression/encoding), selection mode (latest | timestamp | filename), target Database ref, overwrite flag (default false).
• RestoreReconciler (internal/controller/restore_controller.go): validate source/target, render the runner config Secret (reuse pkg/gobackupconfig), build and own a batch/v1 Job from the runner image, watch the Job → surface status.
• Status mirrors Backup: phase, start/completion time, conditions, last-100-lines logs on failure.
• Register in cmd/main.go; RBAC markers; CRD manifests + hand-sync to the Helm chart; sample manifests.

Out of scope

• Non-Postgres engines / non-S3 backends → support-matrix issue.

Acceptance criteria

• Applying a single Restore manifest restores a Postgres DB from an S3 backup, with phase / conditions / logs reflected in status.
• Overwrite guard enforced; invalid source/target rejected with a clear condition.
• envtest coverage for the reconciler; e2e restores a real backup.

Read api/v1alpha1/restore_types.go and internal/controller/restore_controller.go alongside the existing Backup implementation, then inspect runner #92 and pkg/gobackupconfig. Check cmd/main.go, RBAC markers, CRD and Helm manifests, sample manifests, and the requested envtest/e2e coverage. Done means a single Restore manifest restores PostgreSQL from S3 and reports phase, conditions, and failure logs while enforcing validation and overwrite protection.