fix: P2+P3 bug fixes, hardening, and cleanup (18 files)

Bug fixes:
- Add applyEnvOverrides to LoadFromBytes (M05)
- Set state=failed on compose-up failure in selfupdate (M16)
- Clamp usableMB to min 0 in memory check (M22)
- Remove "manual" schedule from triggerAllCrossBackups (M23)
- Add mmcblk device handling for partition paths (M21)
- Fix stripPartition for mmcblk devices (L25)
- Fix TruncateStr for UTF-8 and negative maxLen (L05/L06)
- Fix AllDone to return false for empty restore plans (L14)
- Fix PushOnce to return actual errors (L39)
- Restore pending events on save failure in DrainPendingEvents (M03)
- Add duplicate check in AddStoragePath (M04)
- Call CleanupTempMounts after drive scan (H13)
- Log SetStep save errors (M25)

Hardening:
- Guard scheduler Start() against double-start (M14)
- Acquire mutex in scheduler Stop() before reading cancel (L24)
- Cap log lines parameter to 10000 (L31)
- Require POST for logout (L32)
- Use sync.Once for Server.Close() (L49)
- Panic on crypto/rand.Read failure in setup CSRF (L40)
- Validate Bearer token against Hub API key in CSRF (H16 fix)
- Replace custom hasPrefix with strings.HasPrefix (L13)
- Replace simpleHash with crc32.ChecksumIEEE (L48)

Cleanup:
- Remove dead imageName function (L02)
- Remove dead detectHostIPViaRoute function (L03)
- Rename shadowed copy variable to cp (L07)
- Copy DefaultEnabledEvents in GetNotificationPrefs early return (L09)
- Update BUGHUNT.md with comprehensive audit results

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/selfupdate/updater.go

@@ -229,13 +229,6 @@ func registryImagePath(image string) string {
 	return image
 }
 
-// imageName extracts the repo name from a full image reference.
-// e.g., "gitea.dooplex.hu/admin/felhom-controller" → "felhom-controller"
-func imageName(image string) string {
-	parts := strings.Split(image, "/")
-	return parts[len(parts)-1]
-}
-
 // DryRunResult holds the result of a self-update dry run.
 type DryRunResult struct {
 	CurrentVersion  string `json:"current_version"`
@@ -399,8 +392,10 @@ func (u *Updater) performUpdate(targetVersion, targetImage, previousImage, initi
 	composeDir := strings.TrimSuffix(u.composePath, "/docker-compose.yml")
 	upOut, upErr := runCommand("docker", "compose", "-f", u.composePath, "-p", "felhom-controller", "up", "-d")
 	if upErr != nil {
-		// If we get here, compose up failed but we already changed the image tag.
-		// Log the error — the state file remains "pending" for manual investigation.
+		state.Status = "failed"
+		state.Error = fmt.Sprintf("docker compose up -d failed: %v — %s", upErr, upOut)
+		state.CompletedAt = time.Now().UTC().Format(time.RFC3339)
+		SaveState(u.dataDir, state)
 		u.logger.Printf("[ERROR] docker compose up -d failed: %v — %s (dir: %s)", upErr, upOut, composeDir)
 		return
 	}