fix(R-1218, R-1219): stage the off-site password when its file exists; no recovery ceremony during a recovery offer

R-1218: escrowStart stages when OffboxRepoPasswordOnBox() (not OffboxConfigured()). R-1219: the top bar hides during an
offer; the start handler answers 409 (api.escrow.recovery_offer_open, hu+en) before staging. Red-proved. Commit only.

CHANGELOG.md

@@ -14,6 +14,15 @@ hub answers 400 to both and nothing else changes.
   lists — and never offers to delete — that app's live folder; one WARN names the app. Before: a parse error gave a nil
   `AppConfig`, the app read as not installed, its folder was a „leftover". Test `TestR1220_AnUnreadableAppYamlKeepsTheFolderLive`
   (with a real leftover as the control), red-proved against the old code.
+- **R-1218 (P2, key code):** the recovery ceremony stages the off-site repository password whenever the password FILE is
+  on the box (`backup.Manager.OffboxRepoPasswordOnBox`), not only when off-site is configured — a cleared or switched-off
+  target keeps the file, and a ceremony that sealed no password let the hub demote the household's good package (the
+  hub half refuses that demotion: felhom.eu hub, same night). Test `TestR1218_TheCeremonyStagesWhenThePasswordFileExists`
+  (off, cleared, and a box with no password as the control), red-proved („preflight,start" — no stage).
+- **R-1219 (P2, key code):** during a recovery offer the top bar no longer urges the ceremony, and `POST
+  /api/escrow/start` answers 409 with `api.escrow.recovery_offer_open` (hu + en) before anything is staged or started.
+  Tests `TestR1219_*` (the bar with a real session, and the same box without an offer as the control), red-proved (bar
+  shown, start 200).
 - `settings.RestoreHold.Why()` / `WireReason()`: the hold sentence moved out of `cmd/controller` (`holdWhy` calls it), so
   `--restore-holds` and the hub's list say the same thing.
 - Tests `internal/holdreport/holdreport_test.go` (8): the report field, the daily repeat, cleared once, cleared while