fix: Improve encryption detection for cluster backups

- Check cluster metadata first before single DB metadata
- For cluster backups, mark as encrypted only if ANY database is encrypted
- Remove double confirmation requirement for --workdir in dry-run mode
- Fixes false positive 'encrypted backup detected' for unencrypted cluster backups

This allows --clean-cluster and --workdir flags to work correctly with unencrypted backups.

cmd/restore.go

@@ -503,14 +503,6 @@ func runRestoreCluster(cmd *cobra.Command, args []string) error {
 			log.Warn("⚠️  Using alternative working directory for extraction")
 			log.Warn("    This is recommended when system disk space is limited")
 			log.Warn("    Location: " + restoreWorkdir)
-			
-			// Interactive confirmation required
-			if !restoreConfirm {
-				fmt.Printf("\n⚠️  Alternative extraction directory: %s\n", restoreWorkdir)
-				fmt.Printf("   This location will be used for temporary extraction.\n")
-				fmt.Printf("   Add --confirm flag to proceed.\n\n")
-				return fmt.Errorf("confirmation required for --workdir usage")
-			}
 		}
 
 		log.Info("Checking disk space...")