store: restore sessions on boot; chunk replay and resume survive restart

[rubenhensen]

Sub-issue of #116 (epic: encryption4all/postguard#247, workstream E). Second half: restarts stop killing uploads — the class behind postguard-website#117 (chunk PUT 404 after deploy, orphaned files).

• On boot: load unexpired sessions from SQLite; expired-while-down sessions get their on-disk partials cleaned up (the upload_init creates an empty file before validating recipient, leaking orphans on bad input #125-style orphan class).
• Chunk replay and resume work across a restart: rolling-token chain (sha256(prev||body)) validates from persisted tokens; GET /fileupload/{uuid}/status with X-Recovery-Token works; idempotent replay of the last chunk still works.
• Integration test simulating restart: init → PUT chunk → rebuild the Rocket instance on the same data_dir/db → PUT next chunk → finalize succeeds end to end.

Done when: the restart test passes; a mid-upload restart no longer produces 404s or orphaned files.