attacker.localhost
1. Setup — pick a file (creates persisted grant)
2. Trigger — request restore in 3s (click victim pane before it fires)