Add explicit database import UI and harden SQL restore.

app.py

@@ -103,7 +103,7 @@ else:
     application_path = os.path.dirname(__file__)
 
 DATA_FILE = os.path.join(application_path, 'data.json')  # legacy JSON; used only for one-shot import / export
-CURRENT_VERSION = "v2.6.9"
+CURRENT_VERSION = "v2.7.0"
 RELEASES_REPO_URL = repo_url()
 RELEASES_API_LATEST = api_latest_url()
 BIN_DIR = os.environ.get('TUNNEL_BIN_DIR', os.path.join(application_path, 'bin'))
@@ -6940,7 +6940,9 @@ async def api_backup_download_json(request: Request):
 
 
 @app.post('/api/settings/backup/restore', tags=["Settings"])
+@app.post('/api/settings/backup/import', tags=["Settings"])
 async def api_backup_restore(request: Request, file: UploadFile = File(...)):
+    """Import panel database from a .sql / .sql.gz dump or legacy data.json."""
     if not _check_admin(request):
         return JSONResponse({'error': 'Forbidden'}, status_code=403)
     try:
@@ -6949,7 +6951,11 @@ async def api_backup_restore(request: Request, file: UploadFile = File(...)):
             return JSONResponse({'error': 'Empty file'}, status_code=400)
 
         filename = (file.filename or '').lower()
-        is_json = filename.endswith('.json') or content.lstrip().startswith(b'{')
+        is_gzip = filename.endswith('.gz') or content[:2] == b'\x1f\x8b'
+        is_json = (
+            not is_gzip
+            and (filename.endswith('.json') or content.lstrip()[:1] in (b'{', b'['))
+        )
 
         if is_json:
             try: