R-1256: four restore edges (review round 2 HUNT-1 H4/H5/H6/H8) — each test seen failing first

H4: a failed definition write in the off-site restore writes the live definition back before the start;
    a failed write-back holds the app (restore_mixed).
H5: a put-back whose stop fails pours nothing, keeps the copy and holds the app (off-site, local, power-cut);
    a failed definition write-back keeps the copy (D20); a failed 'volume rm -f' fails that volume (no merge).
H6: TryBeginRestoreOp/RestoreBusy: check every operation and record the restore in one step under m.mu;
    every web handler and the kept loads begin through it; install-time kept load asks about the mirror too.
H8: SweepUnusedRestoreCopies every 6 h: removes a copy only with no hold, no marker naming it, no restore
    running, and older than 14 days.

Commit only; rides the next controller release.

controller/internal/web/kept_handlers.go

@@ -217,16 +217,23 @@ func (s *Server) keptLoadHandler(w http.ResponseWriter, r *http.Request) {
 		_, err := s.stackMgr.RestoreKeptFiles(it)
 		return err
 	}
+	// R-1256 H6: the load begins in the same step as the check for every other operation; a refusal moves nothing
+	// (the dated folder's files move back inside the operation, as prepare).
+	var lErr error
 	if c.Tier == backup.KeptTierOffsite {
 		s.logger.Printf("[INFO] [web] kept LOAD %s: %s from the off-site snapshot %s (from %s)", it.App, it.Path, c.SnapshotID, r.RemoteAddr)
-		s.backupMgr.LoadKeptOffsite(app, it.Drive, c, moveBack, okMsg, failMsg, after)
+		lErr = s.backupMgr.LoadKeptOffsite(app, it.Drive, c, moveBack, okMsg, failMsg, after)
 	} else {
-		if err := moveBack(); err != nil {
-			s.keptRedirect(w, r, "flash_error", s.errText(r, err))
-			return
-		}
 		s.logger.Printf("[INFO] [web] kept LOAD %s: %s from %s (from %s)", it.App, it.Path, c.UnitDir, r.RemoteAddr)
-		s.backupMgr.LoadKeptApp(app, c.UnitDir, okMsg, failMsg, after)
+		lErr = s.backupMgr.LoadKeptApp(app, c.UnitDir, moveBack, okMsg, failMsg, after)
+	}
+	if lErr != nil {
+		msg, _ := s.restoreOpBlocked()
+		if msg == "" { // the other operation ended in the meantime
+			msg, _ = s.restoreBusyMessage(backup.RestoreBusyRestore, "")
+		}
+		s.keptRedirect(w, r, "flash_error", msg)
+		return
 	}
 	http.Redirect(w, r, "/backups/restore?"+flashQuery("flash", "flash.restore.started"), http.StatusFound)
 }