feat(mcp): add restore plan and integrity checks

[corylanou]

Description

Adds a read-only litestream_restore_plan MCP tool that resolves configured database paths and replica URLs in-process, accepts optional TXID or timestamp targets, and returns the ordered restore plan produced by litestream.CalcRestorePlan. The tool advertises readOnlyHint: true and does not create its optional output path.

Adds an integrity_check option to litestream_restore with none, quick, and full modes, passes the selected mode to the restore library, and reports it in the restore result.

This is a stacked PR containing only the issue #1371 delta above #1367. It does not pull in other MCP branches.

Motivation and Context

The MCP restore surface could perform a restore but could not safely preview the snapshot and LTX files that would be applied. It also always reported the integrity mode as none and provided no way to request the library-supported post-restore checks.

Investigation evidence:

• The MCP restore schema had no dry-run or integrity-check input.
• The MCP restore result hard-coded integrity_check to none.
• The refactor(mcp): call Litestream in-process instead of exec-ing a PATH binary #1367 base provides in-process replica resolution, while the existing restore plan path delegates to litestream.CalcRestorePlan.

Closes #1371

How Has This Been Tested?

• go test ./cmd/litestream -run 'Test(RestorePlanTool|RestoreTool|MCP)' -count=1
• go test -v ./cmd/litestream
• go build ./...
• go test ./...
• go test -race -v ./...
• pre-commit run --all-files

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (would cause existing functionality to not work as expected)

Checklist

• My code follows the code style of this project (go fmt, go vet)
• I have tested my changes (go test ./...)
• I have updated the documentation accordingly (if needed)

[github-actions]

PR Build Metrics

✅ All clear — no issues detected

Check	Status	Summary
Binary size	✅	37.05 MB (+16.0 KB / +0.04%)
Dependencies	✅	No changes
Vulnerabilities	✅	None detected
Go toolchain	✅	1.25.12 (latest)
Module graph	✅	1240 edges (0)

Binary Size

	Size	Change
Base (dcefbbf)	37.03 MB
PR (6ce9276)	37.05 MB	+16.0 KB (+0.04%)

Dependency Changes

No dependency changes.

govulncheck Output

=== Symbol Results ===

No vulnerabilities found.

Your code is affected by 0 vulnerabilities.
This scan also found 0 vulnerabilities in packages you import and 1
vulnerability in modules you require, but your code doesn't appear to call these
vulnerabilities.
Use '-show verbose' for more details.

Build Info

Metric	Value
Build time	43s
Go version	go1.25.12
Commit	6ce9276

History (2 previous)

Commit	Updated	Status	Summary
10df4c4	2026-07-18 20:43 UTC	✅	37.01 MB (+16.0 KB / +0.04%)
63d4816	2026-07-17 16:19 UTC	✅	37.01 MB (+16.0 KB / +0.04%)

---

_{🤖 Updated on each push.}