R-1256: four restore edges (review round 2 HUNT-1 H4/H5/H6/H8) — each test seen failing first

H4: a failed definition write in the off-site restore writes the live definition back before the start;
    a failed write-back holds the app (restore_mixed).
H5: a put-back whose stop fails pours nothing, keeps the copy and holds the app (off-site, local, power-cut);
    a failed definition write-back keeps the copy (D20); a failed 'volume rm -f' fails that volume (no merge).
H6: TryBeginRestoreOp/RestoreBusy: check every operation and record the restore in one step under m.mu;
    every web handler and the kept loads begin through it; install-time kept load asks about the mirror too.
H8: SweepUnusedRestoreCopies every 6 h: removes a copy only with no hold, no marker naming it, no restore
    running, and older than 14 days.

Commit only; rides the next controller release.

controller/internal/web/handlers.go

@@ -1894,7 +1894,10 @@ func (s *Server) backupRestoreHandler(w http.ResponseWriter, r *http.Request) {
 	}
 
 	s.logger.Printf("[WARN] [web] Restore requested (async): stack=%s, snapshot=%s from %s", stackName, snapshotID, r.RemoteAddr)
-	s.backupMgr.BeginRestoreOp("restore", stackName)
+	if msg, ok := s.beginRestoreOp("restore", stackName); !ok {
+		http.Redirect(w, r, "/backups/restore?flash_error="+url.QueryEscape(msg), http.StatusFound)
+		return
+	}
 	go func() {
 		start := time.Now()
 		// Phase 2b: restore from the app's recovery unit (recovers secrets from the guest, fail-closed
@@ -2236,7 +2239,10 @@ func (s *Server) backupTier2RestoreHandler(w http.ResponseWriter, r *http.Reques
 	}
 
 	s.logger.Printf("[WARN] [web] Tier-2 file restore requested (async): stack=%s from %s", stackName, r.RemoteAddr)
-	s.backupMgr.BeginRestoreOp("tier2-restore", stackName)
+	if msg, ok := s.beginRestoreOp("tier2-restore", stackName); !ok {
+		http.Redirect(w, r, "/backups/apps?flash_error="+url.QueryEscape(msg), http.StatusFound)
+		return
+	}
 	go func() {
 		n, err := s.backupMgr.RestoreTier2Files(stackName)
 		if err != nil {
@@ -2311,7 +2317,10 @@ func (s *Server) backupTier2UnitRestoreHandler(w http.ResponseWriter, r *http.Re
 	// (R-538), which is what left such an app with no way back from the second drive.
 	if s.backupMgr.HasDriveFileLegs(stackName) {
 		s.logger.Printf("[WARN] [web] Tier-2 WHOLE restore requested (async, files + database): stack=%s from %s", stackName, r.RemoteAddr)
-		s.backupMgr.BeginRestoreOp("tier2-whole-restore", stackName)
+		if msg, ok := s.beginRestoreOp("tier2-whole-restore", stackName); !ok {
+			http.Redirect(w, r, "/backups/apps?flash_error="+url.QueryEscape(msg), http.StatusFound)
+			return
+		}
 		go func() {
 			start := time.Now()
 			res, err := s.backupMgr.RestoreTier2Whole(stackName)
@@ -2346,7 +2355,10 @@ func (s *Server) backupTier2UnitRestoreHandler(w http.ResponseWriter, r *http.Re
 	}
 
 	s.logger.Printf("[WARN] [web] Tier-2 UNIT restore requested (async, OVERWRITES live data): stack=%s from %s", stackName, r.RemoteAddr)
-	s.backupMgr.BeginRestoreOp("tier2-unit-restore", stackName)
+	if msg, ok := s.beginRestoreOp("tier2-unit-restore", stackName); !ok {
+		http.Redirect(w, r, "/backups/apps?flash_error="+url.QueryEscape(msg), http.StatusFound)
+		return
+	}
 	go func() {
 		start := time.Now()
 		res, err := s.backupMgr.RestoreTier2Unit(stackName)