v0.53.0: restore guests INTO the felhom pool (pool-scoped-ACL enabler)

RestoreLXCOptions.Pool → pct restore --pool (omit-when-empty). New
reconcile.DefaultPool="felhom"; BringUpSpec.Pool threaded to the bring-up
restore; BOTH restore sites pool the guest (provision/DR via spec.Pool set to
DefaultPool by the CLI; restore-test scratch via DefaultPool = SPIKE residual
#2). No agent ACL change (ships in host-install v1.6.0); the pool param is inert
until the token has Pool.Allocate + the pool exists, so publishing is safe ahead
of the coordinated swap. Tests + red-proofs; go build/vet/test clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

internal/proxmox/restore_test.go

@@ -0,0 +1,39 @@
+package proxmox
+
+import (
+	"context"
+	"io"
+	"net/http"
+	"strings"
+	"testing"
+)
+
+// RestoreLXC sends pool= only when Pool is set. Under a pool-scoped token the restore MUST carry
+// pool=felhom (else VM.Allocate/Pool.Allocate 403); with Pool empty it MUST be omitted (a naive
+// unconditional Set would send an empty pool= — omit-when-empty is the guarantee).
+func TestRestoreLXC_PoolParam(t *testing.T) {
+	var body string
+	d := &mockDoer{fn: func(r *http.Request) (*http.Response, error) {
+		b, _ := io.ReadAll(r.Body)
+		body = string(b)
+		return jsonResp(200, `{"data":"`+testUPID+`"}`), nil
+	}}
+	c := newTestClient(d)
+	ctx := context.Background()
+
+	// Pool set → pool=felhom present in the POST body.
+	if _, err := c.RestoreLXC(ctx, RestoreLXCOptions{VMID: 9100, Archive: "local:backup/a.tar.zst", Storage: "local-lvm", Pool: "felhom"}); err != nil {
+		t.Fatalf("RestoreLXC(Pool): %v", err)
+	}
+	if !strings.Contains(body, "pool=felhom") {
+		t.Errorf("Pool set: expected pool=felhom in body, got %q", body)
+	}
+
+	// Pool empty → NO pool key at all (omit-when-empty).
+	if _, err := c.RestoreLXC(ctx, RestoreLXCOptions{VMID: 9100, Archive: "local:backup/a.tar.zst", Storage: "local-lvm"}); err != nil {
+		t.Fatalf("RestoreLXC(no Pool): %v", err)
+	}
+	if strings.Contains(body, "pool=") {
+		t.Errorf("Pool empty: pool key must be ABSENT, got %q", body)
+	}
+}