v0.246.0: an interrupted restore is told; the recovery-code reminder waits until the box can take it

MinAgent: 0.131.0 (unchanged). Requires hub v0.117.0 for restore_interrupted.

R-550 (operator ruling: fix). A design reversed and recorded: the restore
op-status was in memory by choice. Now restore-status.json in DataDir, written
atomically at both ends of an op. At startup a record still marked running
becomes a failed, interrupted result kept per app until that app's next
restore, shown on /backups/restore and the off-site wizard, and raised once as
restore_interrupted. Cooldowns stay in memory.

R-546. The R-543 reminder bar consults the agent's own preflight ok (every
blocking item, not a copy of pbs_storage_id), cached 60 s, probed only while
paused. /backup/escrow shows a waiting card that polls and reloads instead of
red crosses and English diagnostics. POST /api/escrow/start refuses 409 before
staging or starting - the direct path chaos night used. Unknown readiness keeps
the bar.

Red-proofs (each seen failing): restore record across restart; main() calls
both startup functions; startup helper with loading skipped; restore page card;
bar held back; waiting card; start refusal. go build/vet/test ./... green, 28
packages; controller_gates --fast all OK.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/handlers.go

@@ -1067,6 +1067,10 @@ func (s *Server) backupsAppsHandler(w http.ResponseWriter, r *http.Request) {
 // restore-to-verify list and the .fab export/import loop.
 func (s *Server) backupsRestoreHandler(w http.ResponseWriter, r *http.Request) {
 	data := s.backupsCommonData("backups-restore", "Biztonsági mentés — Visszaállítás", r)
+	// R-550: restores the box was running when it stopped — shown until that app is restored again.
+	if s.backupMgr != nil {
+		data["InterruptedRestores"] = s.backupMgr.InterruptedRestores()
+	}
 	s.backupsOffboxData(data) // restore-to-verify lists the offbox-toggled apps
 	// Full-restore two-step reveal (§7.2): after the size+headroom prepare step, offboxRestoreHandler
 	// redirects here with the app + human size so the confirm section can show the size BEFORE starting.