Restore legacy project archives and redirect recovered public URLs

[szweibel]

Legacy projects left in the original storage account cannot be recovered by the current same-bucket, first-login import. Add a private administrative receiver that validates a reviewed archive, restores its files through the existing owner and migration coordinators, and records a retryable completion receipt. Existing destination files are preserved and private projects remain private.

Recovered published addresses under /sites/:legacyOwner/:slug redirect to the current /u/:handle/:slug address only through an explicit completed recovery record. Redirects follow project renames, stop after unpublishing, and never serve arbitrary legacy namespaces. A forward-only recovery handle leaves the user's primary public username available to claim.

The caller is AdmissionAgentAdmin.restoreSiteStudioLegacyProjects in Admission PR 240. Release this receiver first, then Admission, then Doorway's administrative adapter and public redirect routing. Original archives remain outside the destination bucket; rolling back code does not reverse a completed data restore.

Validation:

• bun run check: app 759 tests, chat and preview boundary checks, frontend 225 tests, type checks and production build.
• Actual local Workers integration: MCP → Admission's SQLite Durable Object → Site Studio's R2/KV/Durable Objects; restoration, lost-response retry, exact account matching, non-admin denial, public redirects, rename state, and unpublish behavior passed.
• Interrupted-source-deletion and completion-receipt failures exercise the actual coordinator methods.
• Independent GPT-6 Astra source review completed with no remaining blocking findings.

Implemented by Codex GPT-5.6 Sol, coordinated and reviewed by GPT-6 Astra. Local checks use synthetic accounts and do not claim a real CUNY login or production restoration.

Receiver release verified: main f9ae41e0f547dd1a59c27718ffbb0964118c762a, CI run 35761722514, serving version 8af40205-c1b1-4263-9ab3-638956853e7d at 100%. A temporary local caller reached the production private entrypoint and both malformed-input readiness calls returned the expected invalid receipt before data access. The helper was removed. This proves receiver availability; the dependent Admission/Doorway release and actual user restore remain pending.

Production verification completed September 22, 2026: the supported Admission admin action returned restored for the seven-project archive (47 stored objects). The old published address returns 302 with Cache-Control: no-store; its canonical destination returns 200 with the expected document and opaque-origin sandbox. All six private legacy routes and protected metadata return 404. The original archive remains preserved. Ian's own dashboard/login confirmation is still a human follow-up.

Deployed commits: Admission/Doorway 7afbbcad7e4c6175896c5d73fb4885e2a5ca1a59; Site Studio 6916dc5060e43e85dc2ae872e7c78da0ad56efdd. Each was read back at one version serving 100%. Site release 35767394009 passed. The retry used the original saved idempotency request after the focused fix in Site Studio #83.