feat(savedata): recover from rotating backups on hash mismatch

When primary savedata fails its SHA-256 integrity check, query
savedata_backups in recency order and return the first slot that
decompresses cleanly. Recovery is read-only — the next successful
Save() overwrites the primary with fresh data and a new hash,
self-healing the corruption transparently.

Closes #178

server/channelserver/repo_interfaces.go

@@ -48,6 +48,9 @@ type CharacterRepo interface {
 	// LoadSaveDataWithHash loads savedata along with its stored SHA-256 hash.
 	// The hash may be nil for characters saved before checksums were introduced.
 	LoadSaveDataWithHash(charID uint32) (id uint32, savedata []byte, isNew bool, name string, hash []byte, err error)
+	// LoadBackupsByRecency returns all backup slots for a character ordered
+	// most-recent first. Returns an empty slice if no backups exist.
+	LoadBackupsByRecency(charID uint32) ([]SavedataBackup, error)
 }
 
 // GuildRepo defines the contract for guild data access.