Why a QNAP firmware rollout triggered a ransomware scramble and the forensic restore workflow that recovered shares