xtask migrate: add per-database --db flag for selective rollback (op-infra Step 4 follow-up)

Context

cargo xtask migrate rollback (shipped in op-infra Step 4) wipes all 19 databases in the manifest. There is no way to roll back just one service's database — useful when only one migration broke and you don't want to nuke siblings.

The runbook documents the workaround (run pg_restore directly via docker exec -i), but a first-class flag would be friendlier.

Acceptance criteria

1. cargo xtask migrate rollback --db canopy_snap [--db canopy_tanf] restores only the named databases.
2. cargo xtask migrate rollback (no flag) keeps current behavior — restore everything in the manifest.
3. Validate that all --db values match a database in the chosen snapshot's manifest before any restore runs (fail fast if a typo).
4. Runbook updated with the new flag.

Out of scope

• Per-table rollback (overkill — restore the whole DB, then forward-fix).
• Snapshotting a single DB (snapshots are cheap; full snapshots are simpler operationally).

Source

Op-infra plan Step 4 implementation, footnoted as a deferred sub-task.