feat(backup): add audited backup listing and restoration

PLANS.md

@@ -268,7 +268,7 @@ Allowed status values: `NOT STARTED`, `IN PROGRESS`, `BLOCKED`, `DONE`.
 | M5        | DONE        | Client detail, config export, and QR display         |
 | M6        | DONE        | Safe client removal and archival                     |
 | M7        | DONE        | Diagnostics engine and report                        |
-| M8        | NOT STARTED | Backup listing/restoration and audit log UX          |
+| M8        | DONE        | Backup listing/restoration and audit log UX          |
 | M9        | NOT STARTED | TUI foundation, dashboard, and read-only screens     |
 | M10       | NOT STARTED | Complete TUI mutation workflows                      |
 | M11       | NOT STARTED | Hardening, documentation, and MVP acceptance         |
@@ -1663,6 +1663,20 @@ Use this template:
 - Suggested commit message: `feat(diagnostics): add read-only WireGuard health checks`
 - Next milestone: M8
 
+## 2026-10-13 — M8 — DONE
+
+- Implemented: structured secret-safe audit events for mutations, apply, backup, and rollback outcomes; bounded newest-first `log`; serialized explicit `backup`; validated `backups` listing; and confirmed, interface-bound `restore BACKUP [--yes]` with pinned source identity, current-state backup, transactional apply, and disk/runtime rollback.
+- Coordinator: `gpt-5.6-sol` (`high`)
+- Subagents: `milestone_worker` / `milestone_repairer`, `gpt-5.6-luna` (`medium`)
+- Repair cycles: 11
+- Sol review: replaced shallow aliased M8 tests; corrected literal and false audit outcomes; added truthful transaction/backup/apply/rollback events; hardened concurrent audit creation, locking, identity checks, filtering, and limits; fixed backup-list pipeline, ownership, link, containment, malformed-entry, and manifest-swap handling; added manual-backup post-lock revalidation, retention, failure audit, and replacement detection; and made restore identifiers strict, source snapshots identity-pinned, confirmations explicit, and apply/rollback failures fully covered.
+- Verification: `bash -n wg-manager.sh`, `bash -n tests/run.sh`, `bash -n tests/mocks/bin/flock`, `bash tests/run.sh audit`, `bash tests/run.sh audit-no-secrets`, `bash tests/run.sh backup-list`, `bash tests/run.sh restore`, `bash tests/run.sh restore-invalid`, `bash tests/run.sh restore-rollback`, `bash tests/run.sh backup-path-safety`, `bash tests/run.sh runtime-file-modes`, `bash tests/run.sh`, `git diff --check`, permission, scope, opened-file identity, retention, concurrency, rollback, and secret-pattern review.
+- Result: all required checks passed; audit/audit-no-secrets/backup-list/restore/restore-invalid/restore-rollback/backup-path-safety/runtime-file-modes passed 17/5/11/5/8/5/7/14 assertions, and the full regression suite passed 706 assertions. Optional `shellcheck wg-manager.sh tests/*.sh tests/mocks/bin/*` was `SKIP` because ShellCheck is unavailable.
+- Decisions: none
+- Known limitations: real WireGuard, `/etc/wireguard`, networking, systemd, firewall, routes, sysctl, journal, real terminal confirmation, and deployment-server behavior were not accessed or tested; M8 verification is fixture- and mock-based as required. Restore intentionally covers only the server configuration, not archived client artifacts.
+- Suggested commit message: `feat(backup): add audited backup listing and restoration`
+- Next milestone: M9
+
 # 8. Final completion rule
 
 The MVP is complete only when: