v0.12.3 — Security & correctness bug fixes (33 bugs)

CRITICAL: 10 data race and security fixes — backup.go mutex coverage
(C1-C4), IsSystemDisk 12-bit major/minor (C5), /dev/ path validation
(C6), extractName traversal (C7), TargetPath/DestinationPath against
registered paths (C8-C9), ParseComposeHDDMounts Clean-before-prefix (C10).

HIGH: 17 logic/resource fixes — ValidateDump bufio.Scanner (H1), single
appDirSize() with 30s timeout (H2/H3), snapshot ID regex (H4), cross-drive
restic prune (H5), temp file order (H6), dirSizeBytes errors (H7), atomic
fstab (H8), IsDeviceMounted suffix check (H9), eMMC partition mapping (H10),
bytesCopied mutex (H11), separator-aware migrate prefix (H13), DeleteStack
error on compose-down (H14), docker 60s timeout (H16), NotificationPrefs
deep-copy (H17), wipefs warning (H18), fstab rollback on mount fail (H19).

MEDIUM: 7 code quality fixes — formatBytes dedup (M1), .tmp filter order
(M2), sizeBytes string type (M3), elapsed in message (M6), LoadLocation
fallback (M7), pathCovers separator (M10), cancelEditLabel textContent (M11).

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

controller/internal/storage/migrate.go

@@ -124,8 +124,9 @@ func MigrateAppData(
 	// --- Step 3: rsync ---
 	var bytesCopied int64
 	for i, srcPath := range req.HDDMounts {
-		// Determine destination path: replace CurrentHDDPath prefix with TargetPath
-		if !strings.HasPrefix(srcPath, req.CurrentHDDPath) {
+		// Determine destination path: replace CurrentHDDPath prefix with TargetPath.
+		// H13: Require trailing separator to prevent /mnt/hdd matching /mnt/hdd_backup/data.
+		if srcPath != req.CurrentHDDPath && !strings.HasPrefix(srcPath, req.CurrentHDDPath+"/") {
 			continue
 		}
 		relPath := strings.TrimPrefix(srcPath, req.CurrentHDDPath)
@@ -173,11 +174,10 @@ func MigrateAppData(
 		return fail("starting", "Alkalmazás indítása sikertelen az új tárolóról", err)
 	}
 
-	elapsed := int(time.Since(start).Seconds())
 	send("done",
-		fmt.Sprintf("Áthelyezés kész! Az alkalmazás az új tárolóról fut. (Régi adat: %s)", req.CurrentHDDPath),
+		fmt.Sprintf("Áthelyezés kész! Az alkalmazás az új tárolóról fut. (Régi adat: %s, idő: %ds)",
+			req.CurrentHDDPath, int(time.Since(start).Seconds())),
 		100, bytesCopied, totalBytes)
-	_ = elapsed
 
 	return nil
 }
@@ -240,7 +240,11 @@ func runRsync(srcPath, dstPath string, totalBytes, prevCopied int64, basePct int
 	io.Copy(&stderrBuf, stderr)
 
 	if err := cmd.Wait(); err != nil {
-		return bytesCopied, fmt.Errorf("rsync failed: %w — %s", err, stderrBuf.String())
+		// H11: Read bytesCopied under lock to avoid data race with the progress goroutine.
+		mu.Lock()
+		copied := bytesCopied
+		mu.Unlock()
+		return copied, fmt.Errorf("rsync failed: %w — %s", err, stderrBuf.String())
 	}
 
 	mu.Lock()