Close remaining review gaps

- restore runs from the web are created under the location's exclusive
  lock, like backup runs
- raw restore writes to an unpredictable temporary name opened with
  exclusive create (never follows a planted symlink) and validates the
  path prefix; the restore service rejects non-canonical paths instead
  of trimming them (occ normalises user input before calling it)
- restore jobs report progress every minute, so a long restore is not
  taken for a dead one
- README: Object Lock turns deletions into delete markers

lib/Repository/Repository.php

@@ -162,6 +162,9 @@ final class Repository {
 
 	/** Restore a snapshot (or only paths starting with $prefix) into a local directory. */
 	public function restore(string $snapshotId, string $target, string $prefix = ''): int {
+		if ($prefix !== '' && !self::isSafePath(rtrim($prefix, '/'))) {
+			throw new RepositoryException('Invalid path prefix');
+		}
 		$count = 0;
 		foreach ($this->streamEntries($snapshotId) as $entry) {
 			if ($prefix !== '' && !str_starts_with($entry['p'], $prefix)) {
@@ -179,8 +182,11 @@ final class Repository {
 			}
 			// Write next to the destination and rename after all blobs verified: at most one file
 			// is ever present twice.
-			$tmp = $dest . '.ngb-restore';
-			$out = fopen($tmp, 'wb');
+			$tmp = $dest . '.ngb-restore-' . bin2hex(random_bytes(6));
+			$out = @fopen($tmp, 'xb'); // fails if anything (including a symlink) already exists there
+			if ($out === false) {
+				throw new RepositoryException('Cannot create a temporary file for ' . $entry['p']);
+			}
 			foreach ($entry['b'] as $id) {
 				fwrite($out, $this->loadBlob($id));
 			}