R-204 item 3: a restore says what it restored, and what it did not (v0.198.0)

mode=unit restores the recovery unit — the app's definition, configuration
and database dumps — and NOT the customer's own files: RestoreOffboxScratch
passes --include <unit path> and the userdata in the same snapshot is excluded
by it. The outcome was one sentence for both modes and named neither scope,
so on the last step of a disaster recovery the customer was told the app had
been restored after the thing they were looking for had not been.

restoreScratchOutcomeMsg states what came back, what did not, and the next
step that gets it. The wizard's intent card states its scope before the choice.
The full-restore size gate is untouched and pinned as unchanged; the default
stays unit, since all three wizard forms set mode explicitly.

controller/internal/web/offbox_handlers.go

@@ -345,15 +345,40 @@ func (s *Server) offboxRestoreHandler(w http.ResponseWriter, r *http.Request) {
 		// customer had no way to look at what they had just asked for. Resolve the real path and say
 		// it. Fall back to the vague wording only if the path can no longer be resolved.
 		where := s.backupMgr.OffsiteRestoreScratchPath(app)
-		msg := "A(z) " + app + " visszaállítva ellenőrző mappába a meghajtón (a meglévő adatok változatlanok)."
-		if where != "" {
-			msg = "A(z) " + app + " visszaállítva ellenőrző mappába: " + where + " (a meglévő adatok változatlanok)."
-		}
-		s.backupMgr.EndRestoreOp(true, msg)
+		s.backupMgr.EndRestoreOp(true, restoreScratchOutcomeMsg(app, where, full))
 	}()
 	offboxRedirectTo(w, r, restoreWizardPath(app), "A távoli visszaállítás elindult — az állapot itt frissül.", false)
 }
 
+// restoreScratchOutcomeMsg builds the OUTCOME flash for a completed scratch restore. Pure, so the
+// wording is unit-testable — this string is the customer's only evidence of WHAT they now have.
+//
+// R-204 item 3 (v0.198.0) — THE DEFECT IT CLOSES. The default restore (`mode=unit`) recovers the
+// recovery unit: the app's definition, its configuration and its database dumps. It does NOT recover
+// the customer's own files; `RestoreOffboxScratch` passes `--include <unit path>` and the userdata
+// paths that ARE in the same snapshot are excluded by it. The old message was one sentence for both
+// modes and named neither scope, so a customer on the last step of a disaster recovery was told
+// „visszaállítva" after the thing they were looking for had not been restored. A success message
+// that does not name its scope is a silent wrong answer, which is this project's most-repeated
+// failure shape.
+//
+// So the unit case states three things in order: what came back, what did NOT, and the next step
+// that gets it. The full case says the files came with it, because otherwise the absence of the
+// warning would be the only difference and an absence is not a statement.
+func restoreScratchOutcomeMsg(app, where string, full bool) string {
+	at := " ellenőrző mappába"
+	if where != "" {
+		at = " ellenőrző mappába: " + where
+	}
+	if full {
+		return "A(z) " + app + " teljes mentése visszaállítva" + at +
+			" — a saját fájljaiddal együtt. A meglévő adatok változatlanok."
+	}
+	return "A(z) " + app + " beállításai és adatbázisa visszaállítva" + at +
+		". A saját fájljaid (dokumentumok, képek, feltöltések) NEM kerültek vissza — ez az ellenőrző visszaállítás csak az alkalmazás beállításait és adatbázisát hozza vissza. " +
+		"Ha a fájljaidra van szükséged, indítsd el a „Teljes visszaállítás előkészítése” lépést ezen az oldalon. A meglévő adatok változatlanok."
+}
+
 // offboxReconstituteHandler is the TRUE offsite restore (R-43, v0.148.0): files overwritten to the
 // snapshot's version + that same snapshot's database replayed + the app restarted, with a safety
 // dump of the current database taken first.