Fix bugs from BUGHUNT.md: restore race conditions, infra backup, DR wiring, docker-setup.sh, restore.html

controller/internal/backup/restore_scan.go

@@ -71,14 +71,46 @@ func (rp *RestorePlan) GetApps() []RestorableApp {
 func (rp *RestorePlan) Snapshot() map[string]interface{} {
 	rp.mu.RLock()
 	defer rp.mu.RUnlock()
+
+	apps := make([]RestorableApp, len(rp.Apps))
+	copy(apps, rp.Apps)
+	drives := make([]DriveInfo, len(rp.Drives))
+	copy(drives, rp.Drives)
+
 	return map[string]interface{}{
 		"ok":     true,
 		"status": rp.Status,
-		"apps":   rp.Apps,
-		"drives": rp.Drives,
+		"apps":   apps,
+		"drives": drives,
 	}
 }
 
+// TryStartRestore atomically sets status to "restoring" if not already restoring.
+// Returns false if a restore is already in progress (prevents double-restore race).
+func (rp *RestorePlan) TryStartRestore() bool {
+	rp.mu.Lock()
+	defer rp.mu.Unlock()
+	if rp.Status == "restoring" {
+		return false
+	}
+	rp.Status = "restoring"
+	return true
+}
+
+// SetStatus sets the overall plan status under lock.
+func (rp *RestorePlan) SetStatus(status string) {
+	rp.mu.Lock()
+	defer rp.mu.Unlock()
+	rp.Status = status
+}
+
+// GetStatus returns the current plan status under lock.
+func (rp *RestorePlan) GetStatus() string {
+	rp.mu.RLock()
+	defer rp.mu.RUnlock()
+	return rp.Status
+}
+
 // UpdateApp updates a single app's status in the plan.
 func (rp *RestorePlan) UpdateApp(name, status, errMsg string) {
 	rp.mu.Lock()
@@ -231,9 +263,13 @@ func dirExists(path string) bool {
 }
 
 // dirIsEmpty returns true if a directory has no entries.
+// Returns false on read errors (assume non-empty — safer for backup detection).
 func dirIsEmpty(path string) bool {
 	entries, err := os.ReadDir(path)
-	return err != nil || len(entries) == 0
+	if err != nil {
+		return false
+	}
+	return len(entries) == 0
 }
 
 // hasUserData checks if the rsync backup dir has user data (not just _config/_db).