Fetch and restore on another machine (bur fetch, --into)

The restore-anywhere workflow, usable on any trusted machine with only the rclone R2 read remote and the age private key. It doesn't use label discovery; you name the app.

• bur fetch APP [--latest | --date TS] [-o FILE] [-i KEY]: pull and decrypt to a plain custom-format .dump (no restore), for loading yourself or inspecting.
• bur restore APP --latest --into <container> [--dbname DB] --yes: pull, decrypt, apply globals, then pg_restore --clean --if-exists into an existing dev DB container ("load prod data into my dev DB"). -i accepts a key file or $BUR_IDENTITY, and the key is never written to disk.
• Restoring into a live target. Stop the app service first (docker compose stop <svc>, restore, then start) so --clean's DROPs don't block on live connections. Never use docker compose down. Set lock_timeout so a contended restore fails fast.
• The dev container's major version must be the same as or newer than the source.

Acceptance

• bur fetch issues --latest -o issues.dump writes a decrypted custom-format dump.
• bur restore issues --latest --into my-dev-db --dbname issues --yes loads prod data, including roles, into an existing container.
• it works on a machine with no bur.enable labels.