fix: Improve encryption detection for cluster backups

- Check cluster metadata first before single DB metadata
- For cluster backups, mark as encrypted only if ANY database is encrypted
- Remove double confirmation requirement for --workdir in dry-run mode
- Fixes false positive 'encrypted backup detected' for unencrypted cluster backups

This allows --clean-cluster and --workdir flags to work correctly with unencrypted backups.

cmd/restore.go

@@ -503,14 +503,6 @@ func runRestoreCluster(cmd *cobra.Command, args []string) error {
 			log.Warn("⚠️  Using alternative working directory for extraction")
 			log.Warn("    This is recommended when system disk space is limited")
 			log.Warn("    Location: " + restoreWorkdir)
-			
-			// Interactive confirmation required
-			if !restoreConfirm {
-				fmt.Printf("\n⚠️  Alternative extraction directory: %s\n", restoreWorkdir)
-				fmt.Printf("   This location will be used for temporary extraction.\n")
-				fmt.Printf("   Add --confirm flag to proceed.\n\n")
-				return fmt.Errorf("confirmation required for --workdir usage")
-			}
 		}
 
 		log.Info("Checking disk space...")

internal/backup/encryption.go

@@ -69,9 +69,21 @@ func EncryptBackupFile(backupPath string, key []byte, log logger.Logger) error {
 
 // IsBackupEncrypted checks if a backup file is encrypted
 func IsBackupEncrypted(backupPath string) bool {
-	// Check metadata first
+	// Check metadata first - try cluster metadata (for cluster backups)
-	metaPath := backupPath + ".meta.json"
+	// Try cluster metadata first
-	if meta, err := metadata.Load(metaPath); err == nil {
+	if clusterMeta, err := metadata.LoadCluster(backupPath); err == nil {
+		// For cluster backups, check if ANY database is encrypted
+		for _, db := range clusterMeta.Databases {
+			if db.Encrypted {
+				return true
+			}
+		}
+		// All databases are unencrypted
+		return false
+	}
+	
+	// Try single database metadata
+	if meta, err := metadata.Load(backupPath); err == nil {
 		return meta.Encrypted
 	}