…rash recovery

Fix three issues found during systems-level review of the snapshot/clone subsystem:

1. **Reverse deletion order in snapshot remove** (critical): Delete DB record
   before filesystem. Previous order (FS first, DB second) left orphaned DB
   records on crash — phantom snapshots visible to users. New order leaves
   orphaned files (harmless, cleaned by GC) on crash instead.

2. **Validate backing path in crash recovery** (medium): When both container
   disk and snapshot disk exist during recovery (Case 2), validate that the
   COW child's backing path actually points to the expected snapshot before
   declaring success. Preserves both files on mismatch for manual inspection.

3. **Log warning on chain walk errors** (low): `read_backing_chain()` now
   emits `tracing::warn` instead of silently swallowing errors, aiding
   diagnosis of partial chain results.

Also adds `is_backing_dependency()` helper that walks full qcow2 backing
chains to detect transitive dependencies, used by `remove()` to check
container disks, other snapshots, and clone bases before deletion.

Includes 67 integration tests covering snapshot create/restore/remove,
clone operations, and deep backing chain scenarios.