refactor(frontend): extract useRecoveryRestore from App.vue

[attson]

Summary

Sixth (largest) slice of milestone 5-a. App.vue owned the entire recovery flow: the ref backing ``, both dialog callbacks, and the ~170-line `executeRestore` fan-out that spawns per-pane along one of four branches (remote re-bind / SSH reconnect / ad-hoc SSH placeholder / local fork with pin migration). None of it referenced App.vue lifecycle — every dependency was either a Ref, a callable, or a lib helper — so it was doing all its work as a passenger inside the mega-SFC.

New `composables/useRecoveryRestore.ts` takes:
```ts
{ tabs, localList, localHostID, pendingLocalIds, pins,
hasLocalPty, newId, gotoTab, startNewTab, predictCellDims }
```
and returns `{ recoveryDialogState, onRecoveryRestore, onRecoveryDiscard }`. The `executeRestore` body moves verbatim (same seed-then-await ordering, same `pins.ready()`/`flushNow()` bracketing, same per-branch behavior). Boot still populates `recoveryDialogState.value = { open: true, snapshot }` directly — the load-and-decide step stays inline because it belongs to the larger try/catch `bootStage` chain.

App.vue side:

• Drop the `recoveryDialogState` ref + `onRecoveryRestore` + `onRecoveryDiscard` + `executeRestore` (~200 lines).
• Drop `classifySSHRestore` / `newSshSessionByID` / `discardRecoverySnapshot` / `synthSessionInfoFromSnapshot` / `buildRestoreSessionReq` / `RecoveryTabSnapshot` imports (all consumed inside the composable).
• Add composable import + single destructuring call (arg lambdas defer the `newId` / `gotoTab` / `startNewTab` references so hoisting order stays clean).
• Keep `RecoverySnapshot` (boot still declares `let recoverySnap: RecoverySnapshot`), `listShells` (used by an unrelated site).

Net: App.vue -201 / +18; new composable +262. App.vue now 1766 lines (was 1949).

Test plan

• `npm test` 1631 pass
• `npm run build` (vue-tsc + vite) green
• Manual: quit desktop with tabs open → relaunch → RecoveryDialog appears → pick a subset → the picked tabs restore (local shells spawn, remote panes re-bind); Discard button clears the snapshot and opens a fresh tab; SSH-by-host panes reconnect via `newSshSessionByID`; ad-hoc SSH panes render the "reconnect to resume" placeholder; pinned local sessions keep their pin across the restart