controller v0.265.0: R-634 cause fixed, held apps say so, OOM storm alarm, R-647 leftovers

R-634: a whole-box backup no longer stops/restarts a DEPLOYING app (the
measured cause of containers running under 'not deployed'); StopStack
and StartStack refuse a deploying stack for every caller.
R-625: held badge 'Stopped - restore needed', no Update button.
R-636: kernel oom_kill counter; 20+ in 30 min -> one app_oom_storm.
R-647: held error per reader, copy_holds key, two log wordings.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/updatebadge.go

@@ -2,6 +2,7 @@ package web
 
 import (
 	"fmt"
+	"strings"
 	"time"
 
 	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
@@ -73,6 +74,18 @@ func compareInstalledToTemplate(s stacks.Stack) updateState {
 // never the decision. A new branch here needs its twin there, and
 // TestLocaleFuncsHungarianBundleMatchesFuncMap fails if hu.json and these literals disagree.
 func updateBadgeAt(s stacks.Stack, now time.Time) *MetaBadge {
+	// R-625 (v0.265.0). A HELD app is stopped, and the only way back is a restore — a newer catalog
+	// version does not lift the hold (`09` §6.1), so „Frissítés elérhető" beside a button that answers
+	// 409 was two verdicts disagreeing. One verdict, read by the badge and by the button (stacks.html
+	// renders no Update button while HoldReason is set), exactly as R-524 did it for Ahead. True for
+	// both hold kinds: a failed restore holds the app stopped too, and the way back is also a restore.
+	if s.HoldReason != "" {
+		return &MetaBadge{
+			Label: "Megállítva — visszaállítás szükséges",
+			Class: "tag-error",
+			Title: firstSentence(s.HoldReason),
+		}
+	}
 	switch compareInstalledToTemplate(s) {
 	case updateCurrent:
 		return &MetaBadge{
@@ -120,3 +133,12 @@ func updateBadgeAt(s stacks.Stack, now time.Time) *MetaBadge {
 //
 // It is INFORMATION ONLY. It is wired to no action, and the Frissítés button is untouched.
 func updateBadge(s stacks.Stack) *MetaBadge { return updateBadgeAt(s, time.Now().UTC()) }
+
+// firstSentence is the hold sentence's opening clause, for a badge title (R-625): up to and including
+// the first full stop that ends a sentence; the whole text when it has none.
+func firstSentence(s string) string {
+	if i := strings.Index(s, ". "); i >= 0 {
+		return s[:i+1]
+	}
+	return s
+}