restore
Reads + decrypts the app-state blob from storage.
Throws
if passkey auth fails
if no backup exists, PRF unavailable, or decryption fails (the latter happens when the blob is from a different passkey or is corrupted; v1 legacy blobs are surfaced as "no backup found").