Function unpack_backup_to_restore_dir 

fn unpack_backup_to_restore_dir(
    backup: &[u8],
    password: &str,
    restore_dir: &Path,
) -> Result<RestoredGuardianConfig>

Unpack a guardian backup tar into restore_dir and parse it.

This function only stages files. It validates archive paths, rejects missing or duplicate required files, verifies the password against the restored API auth, and writes the plaintext password file into the staged directory. The live data directory is not modified here.