v0.15.5: Disaster recovery — Hub-based infra backup, auto-mount, restore UI

Complete DR implementation (TASK2.md Phases 1-4):
- Hub infra-backup push/pull endpoints (controller.yaml, disk layout, stacks)
- Fresh-deployment detection pulls config from Hub, auto-mounts drives by UUID
- Full-page restore UI with drive status, app table, sequential restore
- docker-setup.sh shows DR instructions when customer_id is configured

New files: disk_layout.go, restore_scan.go, restore_app_linux.go,
restore_drives_linux.go, infra_backup.go, infra_pull.go,
handler_restore.go, restore.html

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/web/server.go

@@ -43,6 +43,10 @@ type Server struct {
 
 	// Active raw mount for the attach wizard (empty when not in use)
 	activeRawMount string
+
+	// DR restore mode state
+	restoreMu   sync.RWMutex
+	restorePlan *backup.RestorePlan
 }
 
 func NewServer(cfg *config.Config, stackMgr *stacks.Manager, cpuCollector *system.CPUCollector, backupMgr *backup.Manager, crossDrive *backup.CrossDriveRunner, sched *scheduler.Scheduler, sett *settings.Settings, alertMgr *AlertManager, notif *notify.Notifier, logger *log.Logger, version string) *Server {
@@ -85,10 +89,48 @@ func (s *Server) loadTemplates() {
 	)
 }
 
+// SetRestoreState puts the server into DR restore mode with the given plan.
+func (s *Server) SetRestoreState(plan *backup.RestorePlan) {
+	s.restoreMu.Lock()
+	defer s.restoreMu.Unlock()
+	s.restorePlan = plan
+}
+
+// InRestoreMode returns true if the server is in DR restore mode.
+func (s *Server) InRestoreMode() bool {
+	s.restoreMu.RLock()
+	defer s.restoreMu.RUnlock()
+	return s.restorePlan != nil
+}
+
 // ServeHTTP handles all non-API web requests.
 func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 	path := r.URL.Path
 
+	// DR restore mode: intercept all routes except restore page, static, and restore API
+	if s.InRestoreMode() {
+		switch {
+		case path == "/restore":
+			s.restorePageHandler(w, r)
+			return
+		case path == "/api/restore/status":
+			s.apiRestoreStatus(w, r)
+			return
+		case path == "/api/restore/all" && r.Method == http.MethodPost:
+			s.apiRestoreAll(w, r)
+			return
+		case path == "/api/restore/skip" && r.Method == http.MethodPost:
+			s.apiRestoreSkip(w, r)
+			return
+		case strings.HasPrefix(path, "/static/"):
+			// Allow static assets through
+		default:
+			// Redirect everything else to the restore page
+			http.Redirect(w, r, "/restore", http.StatusFound)
+			return
+		}
+	}
+
 	switch {
 	case path == "/" || path == "/dashboard":
 		s.dashboardHandler(w, r)