Is there a JS API to recover fromPubkey and toPubkey, given a transaction signature?
If you have a transaction signature, you can fetch the transaction using the JSON RPC API's getTransaction endpoint: https://docs.solana.com/developing/clients/jsonrpc-api#gettransaction
This endpoint allows you to ask for jsonParsed encoding, which will actually decode everything for you. Note that not all transactions support JSON parsing.
EDIT: The below is only applicable for encoded transactions, and is not required for system instructions that contain a parser already.
Assuming the encoded transaction actually contains a transfer instruction to the system program, there's a decodeTransfer helper to do this: https://github.com/solana-labs/solana/blob/005592998dd107b3d54d9203babe24da681834f5/web3.js/src/system-program.ts#L266
For other transfers, you'll have to write your own decoder in JS. The Rust side has all of these defined already for you in the solana-transaction-status crate: https://github.com/solana-labs/solana/blob/master/transaction-status/src/parse_instruction.rs