fix: deep bug hunt II — concurrency, security & optimization (25 files)

Critical: watchdog mutex panic safety, SetGeoAppOverride nil guard,
SSD-only app DB restore fallback.

High: double deploy race (atomic Deploying flag), delete/remove during
deploy guard, ScanStacks overwrite protection, FileBrowser mount mutex,
PushEvent history, PushOnce error handling, DB dump sync+close before
rename, restic retry fresh context, encrypt failure logging, cross-backup
path traversal validation, deepCopyStack completeness.

Security: constant-time API key comparison, login rate limiting (5/min),
git credential masking in logs, storage path prefix traversal fix.

Concurrency: MigrateEncryption lock ordering, SubdomainInUse I/O outside
lock, scheduler late-registered jobs, SQLite WAL verification, metrics
shutdown context, telemetry scan error logging, asset sync lock scope.

Optimization: streaming file copy for DB dumps, restic stats dedup,
atomic infra config copy.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/backup/restore_app_linux.go

@@ -154,11 +154,22 @@ func restoreUserData(ctx context.Context, app *RestorableApp, logger *log.Logger
 
 // restoreDBDumps copies DB dump files from cross-drive backup to the primary dump dir.
 func restoreDBDumps(app *RestorableApp, logger *log.Logger) error {
-	if app.DBDumpPath == "" || app.HDDPath == "" {
+	if app.DBDumpPath == "" {
 		return nil
 	}
 
-	destDir := AppDBDumpPath(app.HDDPath, app.Name)
+	// Use HDDPath for apps with HDD data, fall back to DrivePath (system data path)
+	// for SSD-only apps whose DB dumps live under the system drive.
+	drivePath := app.HDDPath
+	if drivePath == "" {
+		drivePath = app.DrivePath
+	}
+	if drivePath == "" {
+		logger.Printf("[WARN] Cannot restore DB dumps for %s: no drive path", app.Name)
+		return nil
+	}
+
+	destDir := AppDBDumpPath(drivePath, app.Name)
 	if err := os.MkdirAll(destDir, 0755); err != nil {
 		return fmt.Errorf("creating dump dir: %w", err)
 	}