Api Prompts Backups Create

Unified restore endpoint.

• {prompt_id} alone → restore from trash (clear deleted_at), or latest S3 backup if not in trash
• {prompt_id, date} → restore from specific date's S3 backup

The restore reads its backup from, and writes into, a single org resolved server-side. Regular callers always get their own org; only a verified superadmin may target another org via organization_id (gated on the staff_write step-up for this write). The destructive pre-restore deletion can therefore never reach an org the caller isn't authorized for.