Replace LRU eviction in restore with reference-counted sweeper

Restore previously capped the blob disk cache at 4× the configured
blob_size_limit (so 40 GB by default). With large or heavily-deduped
snapshots a chunk-by-chunk file walk could blow past that cap and
trigger LRU eviction of blobs that were still needed by later files,
forcing repeated re-downloads — observed during a real restore as
single-stream throughput collapsing to under 1 MB/s.

Restore now allocates the cache with no practical size cap and drives
eviction explicitly:

  * An in-memory set of restored file IDs accumulates as files finish.
  * Every blob_size_limit/100 bytes of restored data (≈100 sweeps per
    blob's worth of writes) the sweeper iterates the cache. For each
    cached blob it queries the snapshot's local SQLite DB for every
    file that references any chunk in the blob and deletes the cache
    entry only when every such file is already in the restored set.
  * blobStillNeeded returns true on any error so an unreadable DB
    never causes premature eviction.

The cache itself gains Delete(key) and Keys() so the sweeper can drive
removal without touching internal LRU state.

internal/vaultik/restore.go

@@ -7,6 +7,7 @@ import (
 	"encoding/hex"
 	"fmt"
 	"io"
+	"math"
 	"os"
 	"path/filepath"
 	"time"
@@ -176,12 +177,22 @@ func (v *Vaultik) restoreAllFiles(
 	chunkToBlobMap map[string]*database.BlobChunk,
 ) (*RestoreResult, error) {
 	result := &RestoreResult{}
-	blobCache, err := newBlobDiskCache(4 * v.Config.BlobSizeLimit.Int64())
+
+	// The restore-side blob cache is unbounded — restores may read any
+	// blob many times across deduplicated files and we want to avoid
+	// re-downloading until we can prove a blob is no longer needed.
+	// Cleanup is driven by the sweeper below, not by LRU.
+	blobCache, err := newBlobDiskCache(math.MaxInt64)
 	if err != nil {
 		return nil, fmt.Errorf("creating blob cache: %w", err)
 	}
 	defer func() { _ = blobCache.Close() }()
 
+	// Per-restore sweep state: every blob_size_limit/100 bytes written,
+	// scan the cache and delete any blob whose remaining file references
+	// are all already restored.
+	sweeper := newRestoreSweeper(v.ctx, repos, blobCache, v.Config.BlobSizeLimit.Int64()/100)
+
 	// Calculate total bytes for progress bar
 	var totalBytesExpected int64
 	for _, file := range files {
@@ -196,7 +207,7 @@ func (v *Vaultik) restoreAllFiles(
 			return nil, v.ctx.Err()
 		}
 
-		if err := v.restoreFile(v.ctx, repos, file, opts.TargetDir, identity, chunkToBlobMap, blobCache, result); err != nil {
+		if err := v.restoreFile(v.ctx, repos, file, opts.TargetDir, identity, chunkToBlobMap, blobCache, sweeper, result); err != nil {
 			log.Error("Failed to restore file", "path", file.Path, "error", err)
 			if !opts.SkipErrors {
 				return nil, fmt.Errorf("restoring %s: %w (pass --skip-errors to continue past restore failures)", file.Path, err)
@@ -211,6 +222,10 @@ func (v *Vaultik) restoreAllFiles(
 			continue
 		}
 
+		// Record the file as restored so the sweeper can free blobs once
+		// all referencing files are done.
+		sweeper.fileRestored(file.ID.String())
+
 		// Update progress bar
 		if bar != nil {
 			_ = bar.Add64(file.Size)
@@ -388,6 +403,7 @@ func (v *Vaultik) restoreFile(
 	identity age.Identity,
 	chunkToBlobMap map[string]*database.BlobChunk,
 	blobCache *blobDiskCache,
+	sweeper *restoreSweeper,
 	result *RestoreResult,
 ) error {
 	// Calculate target path - use full original path under target directory
@@ -410,7 +426,7 @@ func (v *Vaultik) restoreFile(
 	}
 
 	// Handle regular files
-	return v.restoreRegularFile(ctx, repos, file, targetPath, identity, chunkToBlobMap, blobCache, result)
+	return v.restoreRegularFile(ctx, repos, file, targetPath, identity, chunkToBlobMap, blobCache, sweeper, result)
 }
 
 // restoreSymlink restores a symbolic link
@@ -472,6 +488,7 @@ func (v *Vaultik) restoreRegularFile(
 	identity age.Identity,
 	chunkToBlobMap map[string]*database.BlobChunk,
 	blobCache *blobDiskCache,
+	sweeper *restoreSweeper,
 	result *RestoreResult,
 ) error {
 	// Get file chunks in order
@@ -531,6 +548,11 @@ func (v *Vaultik) restoreRegularFile(
 			return fmt.Errorf("writing chunk: %w", err)
 		}
 		bytesWritten += int64(n)
+
+		// Tell the sweeper about the bytes we just restored so it can
+		// run an eviction sweep once the accumulated total crosses its
+		// threshold (config.BlobSizeLimit/100).
+		sweeper.chunkRestored(int64(n))
 	}
 
 	// Close file before setting metadata