make restore system originated agnostic

Author: entr0-pi

README.md

@@ -22,7 +22,7 @@ This application provides a complete, self-hosted certificate authority (CA) man
 - **Certificate Revocation Lists** — Automatic CRL generation and distribution when certificates are revoked; public endpoints for external validators.
 - **Encrypted Storage** — Certificate private keys and sensitive data encrypted at rest; decryption only on demand.
 - **Audit Logging** — Track all certificate operations (creation, renewal, revocation, downloads) with user attribution, role, client IP address, and timestamps. The Recent Operations panel on the dashboard displays IP alongside each event.
-- **Backup & Restore** — Export and restore full backups (database + certificate storage) from the Toolbox without server restart; atomic swaps ensure consistency.
+- **Backup & Restore** — Export and restore full backups (database + certificate storage) from the Toolbox without server restart; atomic swaps ensure consistency; cross-platform restore supported (e.g., Windows → Linux) with matching encryption keys.
 - **Policy-Driven Defaults** — Enforce certificate constraints (validity periods, key algorithms, SAN validation, and root password minimum length) via centralized policy configuration.
 
 ### Use Cases

docs/SECURITY.md

@@ -223,8 +223,10 @@ Operators are responsible for:
   1. Validates ZIP integrity and structure (rejects path traversal attempts, unexpected content)
   2. Verifies SQLite database integrity (`PRAGMA integrity_check`)
   3. Confirms schema version compatibility (must match current application version)
-  4. Performs atomic swap of database and data directory (maintains consistency)
-  5. Preserves recovery backups during the operation
+  4. **Rewrites paths if restoring from a different data directory** (e.g., Windows → Linux, or different environment)
+  5. Performs atomic swap of database and data directory (maintains consistency)
+  6. Preserves recovery backups during the operation
+- Cross-platform restore supported: backups can be restored to a different operating system or directory layout (e.g., Windows backup → Linux deployment) as long as encryption keys match
 - Can be safely run while the application is live (no manual restart required)
 - Upload limits: 5 GB max file size, 10 GB max uncompressed size
 - Error recovery:
@@ -237,8 +239,8 @@ Operators are responsible for:
 - Backup files contain encrypted certificate material (`*.pem.enc`, `*.p12.enc`) with AES-256-GCM encryption
 - Full backups should be stored in a secure location with restricted filesystem access
 - If storing backups off-site or in cloud storage, ensure encryption in transit and at rest
-- The encryption key (`PKI_ENCRYPTION_KEY`) and salt (`PKI_ENCRYPTION_SALT`) must be available to restore from backup
-- Test restore procedures regularly to ensure backup integrity
+- **Critical requirement:** The encryption key (`PKI_ENCRYPTION_KEY`) and salt (`PKI_ENCRYPTION_SALT`) must be identical between backup and restore environments; without matching keys, certificate material cannot be decrypted during restore
+- Test restore procedures regularly to ensure backup integrity, especially for cross-platform or cross-environment restores
 - Backup operations are audit-logged with the requesting user's identity
 
 **Manual Backup Alternative**: