v0.310.0: „A gép kikapcsolása" — the household turns the whole machine off (R-998); honest restart text (R-999)

POST /api/server/poweroff (dashboard login, POST only, the typed word KIKAPCSOLÁS / TURN OFF)
→ agent POST /host/poweroff (MinAgent 0.155.0; hidden for an older agent). The controller refuses
during its own backup/restore/app update; the agent's reasons are shown as household sentences.
„Kiszolgáló újraindítása" becomes „A Felhom újraindítása" and says it restarts the Felhom part;
/api/server/reboot is POST only (R-983). Tests red-proofed; parity fixtures regenerated on purpose.

controller/internal/web/storage_handlers.go

@@ -817,6 +817,12 @@ func (s *Server) handleStorageWipe(w http.ResponseWriter, r *http.Request) {
 // drive-activation banner; in the intermediary-mount model a drive binds live, so no reboot is needed
 // to activate storage — this button is purely a full-server restart.)
 func (s *Server) HandleServerReboot(w http.ResponseWriter, r *http.Request) {
+	// R-983 (one of its seven): CsrfProtect lets a GET through, so a link could restart the guest. POST only.
+	if r.Method != http.MethodPost {
+		w.Header().Set("Allow", http.MethodPost)
+		writeDiskJSON(w, http.StatusMethodNotAllowed, false, "POST only", nil)
+		return
+	}
 	agent, err := s.agentClient()
 	if err != nil {
 		writeDiskJSON(w, http.StatusServiceUnavailable, false, s.errText(r, err), nil)