Restore the SQLite metastore from its backup when the local database is empty

[begelundmuller]

• Restores snapshot.db from the backup bucket on startup when the metastore has no migrations applied, which also covers a zero-length file or a previous startup that crashed before migrating.
• Adds RILL_RUNTIME_METASTORE_BACKUPS_ENABLE (default true), gating both the daily backup and the restore.
• A failed restore fails startup rather than booting empty, since the next nightly backup would otherwise overwrite the snapshot.
• Raises backupMaxSizeBytes from 5 GB to 15 GB so the largest metastores are backed up (and therefore restorable) at all, and bounds a restore at 30 minutes, which is enough to download a snapshot at that limit.