feat: add interactive Kopia restore script, Authelia guidance in CLAUDE.md

- extras/restore_kopia_backup.sh: interactive restore tool — lists all
  snapshot sources, pick source + snapshot, choose inspect (restore to
  /tmp) or restore-in-place (moves current data aside as .pre-restore-DATE
  for easy rollback, auto-stops/starts the associated Docker service)
- services/backup.sh: copy restore script to ~/docker/backup/ during
  install; update summary to show restore command
- CLAUDE.md: add note to update README services table when adding a
  service; add Authelia section documenting which services have built-in
  auth, the import-authelia Caddy pattern for no-auth services, and
  remember_me_duration config for kiosk/persistent sessions

https://claude.ai/code/session_019XgsQ13XKm4Zj3cNsDNwHj

services/backup.sh

@@ -460,6 +460,18 @@ WORKEREOF
     chown root:root "$WORKER" 2>/dev/null || true
     log_success "backup.sh written"
 
+    # ── Copy the interactive restore script from the repo ────────────────────
+    local RESTORE_SRC="${HERE:-}/extras/restore_kopia_backup.sh"
+    local RESTORE_DEST="$BACKUP_DIR/restore_kopia_backup.sh"
+    if [ -f "$RESTORE_SRC" ]; then
+        cp "$RESTORE_SRC" "$RESTORE_DEST"
+        chmod +x "$RESTORE_DEST"
+        chown root:root "$RESTORE_DEST" 2>/dev/null || true
+        log_success "restore_kopia_backup.sh installed"
+    else
+        log_warning "extras/restore_kopia_backup.sh not found — restore script not installed"
+    fi
+
     # ── 8. Install systemd timer (fallback: cron) ────────────────────────────
     local AUTORUN=""
     if command -v systemctl >/dev/null 2>&1 && [ -d /run/systemd/system ]; then
@@ -533,9 +545,10 @@ UNITEOF
     echo "  NOT backed up: ROMs, Steam game installs (re-downloadable)."
     echo ""
     echo "  Commands:"
-    echo "    sudo $WORKER             back up now"
-    echo "    sudo $WORKER snapshots   list snapshots"
-    echo "    sudo $WORKER restore     restore / browse"
+    echo "    sudo $WORKER                         back up now"
+    echo "    sudo $WORKER snapshots               list snapshots"
+    echo "    sudo $RESTORE_DEST                   interactive restore"
+    echo "    sudo $RESTORE_DEST --list            list all snapshot sources"
     echo "    $AUTORUN"
     echo ""
     echo "  Offsite mirror (another computer / cloud): set REMOTE_TYPE + REMOTE_ARGS"