Implements RBAC-based write gating for Intune restore flows, UI affordances, and audit logging; adds tests and specs.