Function apply_import 

pub async fn apply_import(
    payload: &BackupPayload,
    ks: &Keyspaces<'_>,
    seed_store: &Arc<dyn SeedStore>,
    config: &RwLock<AppConfig>,
    store: Option<&Store>,
) -> Result<ImportResult, AppError>

Apply an import: clears all keyspaces and writes the backup data.

When store and TEE KMS config are provided, re-encrypts the imported seed and JWT key with KMS for the bootstrap keyspace. The store parameter is therefore only consumed under feature = "tee"; non-TEE builds receive None and silently skip step 12.

vta_did guard: if the running VTA already has a vta_did in config and it differs from the backup’s, the import is rejected — a foreign backup replacing a live VTA’s state is almost certainly an operator mistake. A fresh install (no vta_did yet) accepts any backup; this covers the legitimate disaster-recovery path. To deliberately migrate an identity, clear the running config first.

The caller is responsible for triggering a soft restart after this returns.