feat: infra backup retention + version picker

Hub: GFS retention (7d/4w/3m, ~14 versions) in new infra_backup_versions
table. Recovery endpoint supports ?version=ID. New /versions API endpoint.
Dashboard shows backup history.

Controller: local drive backups rotated into history/ (last 5 versions).
Setup wizard shows version picker for Hub restores when multiple versions
exist. Scan results enriched with app names, disk count, history badge.
Local restore supports historical versions.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/README.md

@@ -989,19 +989,22 @@ On error, the wizard falls back to the manual form with the error displayed.
 |------|---------|
 | `setup/setup.go` | `NeedsSetup()` detection, `SetupState` persistence to `setup-state.json` |
 | `setup/handlers.go` | HTTP handlers for each wizard step (welcome, scan, hub-restore, fresh, manual) |
-| `setup/scanner.go` | Scans all block devices for `.felhom-infra-backup/` directories via `lsblk` + temp mounts |
+| `setup/scanner.go` | Scans all block devices for `.felhom-infra-backup/` directories (current + `history/`) via `lsblk` + temp mounts; returns rich info (app names, disk count) |
 | `setup/hub.go` | Hub recovery pull (`GET /api/v1/recovery/{id}`) and config download |
 | `setup/csrf.go` | Lightweight CSRF protection (cookie + hidden field, `SameSite=Strict`) |
 | `setup/network.go` | Detects local IPs for LAN access URL display |
-| `setup/templates/` | 7 embedded HTML templates (Hungarian, dark theme matching main UI) |
+| `setup/templates/` | 8 embedded HTML templates (Hungarian, dark theme matching main UI) — includes `setup_hub_versions.html` for Hub backup version picker |
 
 #### Local Infra Backup (`internal/backup/local_infra.go`)
 
 The controller writes infrastructure snapshots to **every connected drive** after each backup cycle and on startup. Location: `<drive>/.felhom-infra-backup/`. Files:
 - `backup.json` — full infra backup (config, settings, disk layout, passwords, stacks)
 - `metadata.json` — schema version, timestamp, customer ID, controller version, SHA256 checksum
+- `history/` — previous backup versions (last 5), rotated automatically before each write
+  - `{timestamp}-backup.json` + `{timestamp}-metadata.json` pairs (timestamp format: `20060102T150405Z`)
+  - Oldest entries pruned when count exceeds 5
 
-During setup wizard drive scan, these backups are discovered, integrity-verified, and offered for one-click restore.
+During setup wizard drive scan, both current and historical backups are discovered, integrity-verified, and offered for one-click restore. The scan results table shows app names/count, disk count, and a "korábbi" badge for historical versions.
 
 #### Recovery Info (`internal/recovery/info.go`)
 
@@ -1019,9 +1022,9 @@ When a system drive fails and is replaced, the recovery flow uses the setup wiza
 3. User opens wizard at http://<LAN-IP>:8081
 4. Hub mode: welcome page shows Hub restore / local scan / fresh install
    Non-hub mode: welcome page shows restore / fresh install
-5. Hub restore: auto-connects to Hub, shows infra backup details
-   Local restore: scans all drives for .felhom-infra-backup/ directories
-6. One-click restore: config, settings, passwords, disk layout
+5. Hub restore: auto-connects to Hub, shows version picker if multiple versions
+   Local restore: scans all drives for .felhom-infra-backup/ directories (current + history/)
+6. User selects backup version → restore: config, settings, passwords, disk layout
 7. Controller restarts into normal mode with full config
 8. Controller auto-mounts surviving drives by UUID from disk layout
 9. Dashboard shows "Visszaállítás" (Restore) page for app-level recovery
@@ -1030,7 +1033,7 @@ When a system drive fails and is replaced, the recovery flow uses the setup wiza
 
 **Backup sources (priority order):**
 1. **Local infra backup** (`.felhom-infra-backup/` on surviving drives) — fastest, no network needed
-2. **Hub recovery endpoint** (`GET /api/v1/recovery/{id}`) — requires retrieval password
+2. **Hub recovery endpoint** (`GET /api/v1/recovery/{id}`) — requires retrieval password, supports `?version=ID` for specific versions; Hub retains ~14 versions via GFS pruning (7 daily / 4 weekly / 3 monthly)
 3. **Manual config** (wizard form) — enter all details manually as last resort
 
 **Hub verification:** After setup, the controller periodically verifies customer standing via the Hub report push response (`customer_blocked` field). If blocked or Hub unreachable for >7 days, the controller enters limited mode (no new deployments).