Prevent self-service backup restore from re-granting revoked provider channels

[Bladestar2105]

Motivation

• Prevent non-admin users from regaining access to provider channels that have been revoked by filtering backup restores against the user's current authorized channels.
• Keep admin restore behavior unchanged so administrators can fully restore backups when needed.
• Clarify the API reference to note that self-service restores cannot re-grant revoked channels.

Description

• Add a snapshot of currently authorized provider channel ids for non-admin restores in restoreBackup and use it to filter data.userChannels before reinserting channels.
• Preserve existing behavior for admins so the filtering step is skipped when req.user.is_admin is true.
• Update docs/API_REFERENCE.md to state that self-service restores are allowed but cannot re-grant revoked channels.
• Add unit tests in tests/controllers/backupController.test.js that verify non-admin restores filter out revoked provider channels and admins restore all backed up channels.

Testing

• Ran unit tests under tests/controllers/backupController.test.js with vitest and the new tests passed.
• Verified the new restore logic by mocking database responses and asserting the number and parameters of INSERT calls for channels.
• No automated tests failed during the rollout.

---

Codex Task

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 37661b571f

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Exclude hidden channels when deriving restorable provider IDs

The new authorization snapshot treats all user_channels rows as currently granted, but channel revocation paths (deleteUserChannel/bulkDeleteUserChannels) mark rows as hidden (is_hidden = 1) instead of deleting them. In that case, a non-admin restore still includes those provider IDs in allowedProviderChannelIds, and the restore re-inserts them as visible channels, so revoked channels can be re-granted despite this fix. The authorization query should filter to active assignments (for example uc.is_hidden = 0) when building the allowed set.

Useful? React with 👍 / 👎.