v0.154.0 — R-48: one restore entry per app, and the intent is a described choice

The offsite restore list rendered up to five inline forms per app row. Two of them —
„Helyreállítás az élő adatok közé (csak a hiányzó fájlok)" and „Teljes visszaállítás
(fájlok + adatbázis)" — were sibling buttons whose difference is whether the customer's
data comes back at all. That mis-selection CAUSED the round-2 incident: an operator who
had read the source pressed the missing-only button and /backup/offbox/reconstitute was
never hit (DIAG-immich-restore-round2-2026-07-19, finding 1).

The rule this establishes: two adjacent controls whose difference is "your data comes
back" vs "your data cannot come back" must never be distinguishable only by layout.

Each row now carries ONE „Visszaállítás…" entry linking to a per-app wizard at
GET /backups/restore/app?name=<app>: three intent CARDS with consequence sentences, a
visible phase strip, danger styling plus the R-43 double-confirm carried over verbatim on
the destructive one, and the pair-honesty panel bound to real OffsiteScratchPair facts.

deriveWizardStep is pure over (op running, size-gate flash, scratch ready); the step is
never accepted from the request, and a running op outranks a stale ?full_prep= so no
commit button survives into a restore. While ANY op runs every mutation form is suppressed
server-side instead of being offered and refused.

No new mutation endpoint: every card posts to the pre-existing /backup/offbox/* handler
with the same field names and gates, and the page works with JavaScript disabled.
internal/{backup,appbackup,selfupdate} untouched. R-45's job registry stays its own item.

Fixes a latent bug found on the way: offboxRedirectTo hardcoded "?" when appending its
flash, which against the wizard's ?name=<app> target would have buried the flash inside
the name value.

No new agent coupling — MinAgent stays 0.90.0.

controller/internal/web/offbox_handlers.go

@@ -30,7 +30,14 @@ func offboxRedirectTo(w http.ResponseWriter, r *http.Request, page, msg string,
 	if isErr {
 		q = "flash_error"
 	}
-	http.Redirect(w, r, page+"?"+q+"="+url.QueryEscape(msg), http.StatusFound)
+	// R-48: `page` may already carry a query (the wizard is /backups/restore/app?name=<app>), so the
+	// separator has to be chosen, not hardcoded — appending a second "?" produces a URL whose flash
+	// silently lands inside the `name` value instead of as its own parameter.
+	sep := "?"
+	if strings.Contains(page, "?") {
+		sep = "&"
+	}
+	http.Redirect(w, r, page+sep+q+"="+url.QueryEscape(msg), http.StatusFound)
 }
 
 // offboxConfigHandler saves the off-box target + (out-of-band) SSH key + known_hosts.
@@ -304,16 +311,18 @@ func (s *Server) offboxRestoreHandler(w http.ResponseWriter, r *http.Request) {
 		defer cancel()
 		sizeHuman, err := s.backupMgr.OffboxRestorePrepareFull(pctx, app)
 		if err != nil {
-			offboxRedirectTo(w, r, "/backups/restore", err.Error(), true)
+			offboxRedirectTo(w, r, restoreWizardPath(app), err.Error(), true)
 			return
 		}
-		http.Redirect(w, r, "/backups/restore?full_prep="+url.QueryEscape(app)+"&full_size="+url.QueryEscape(sizeHuman), http.StatusFound)
+		// R-48: the size-gate reveal now lands on the app's wizard (prepare-confirm step) rather than
+		// on the list page. Same params, same meaning — only the surface that renders them changed.
+		http.Redirect(w, r, restoreWizardPath(app)+"&full_prep="+url.QueryEscape(app)+"&full_size="+url.QueryEscape(sizeHuman), http.StatusFound)
 		return
 	}
 	// Fast-path refuse a concurrent op, then run async on a BACKGROUND context (a proxy read-timeout on
 	// r.Context() would CANCEL the SFTP restore mid-flight — the F4 lesson).
 	if s.backupMgr.IsRunning() {
-		offboxRedirectTo(w, r, "/backups/restore", "Egy mentési/visszaállítási művelet már fut.", true)
+		offboxRedirectTo(w, r, restoreWizardPath(app), "Egy mentési/visszaállítási művelet már fut.", true)
 		return
 	}
 	full := mode == "full"
@@ -338,7 +347,7 @@ func (s *Server) offboxRestoreHandler(w http.ResponseWriter, r *http.Request) {
 		}
 		s.backupMgr.EndRestoreOp(true, msg)
 	}()
-	offboxRedirectTo(w, r, "/backups/restore", "A távoli visszaállítás elindult — az állapot itt frissül.", false)
+	offboxRedirectTo(w, r, restoreWizardPath(app), "A távoli visszaállítás elindult — az állapot itt frissül.", false)
 }
 
 // offboxReconstituteHandler is the TRUE offsite restore (R-43, v0.148.0): files overwritten to the
@@ -363,11 +372,11 @@ func (s *Server) offboxReconstituteHandler(w http.ResponseWriter, r *http.Reques
 	}
 	// This one overwrites live files and replays a database — it must never happen on a stray click.
 	if r.FormValue("confirm") != "1" {
-		offboxRedirectTo(w, r, "/backups/restore", "A teljes visszaállítás megerősítés nélkül nem hajtható végre.", true)
+		offboxRedirectTo(w, r, restoreWizardPath(app), "A teljes visszaállítás megerősítés nélkül nem hajtható végre.", true)
 		return
 	}
 	if s.backupMgr.IsRunning() {
-		offboxRedirectTo(w, r, "/backups/restore", "Egy mentési/visszaállítási művelet már fut.", true)
+		offboxRedirectTo(w, r, restoreWizardPath(app), "Egy mentési/visszaállítási művelet már fut.", true)
 		return
 	}
 	s.backupMgr.BeginRestoreOp("offbox-reconstitute", app)
@@ -384,7 +393,7 @@ func (s *Server) offboxReconstituteHandler(w http.ResponseWriter, r *http.Reques
 			app, res.FilesPlaced, res.DBsReplayed, res.SnapshotID)
 		s.backupMgr.EndRestoreOp(true, reconstituteOutcomeMsg(app, res))
 	}()
-	offboxRedirectTo(w, r, "/backups/restore", "A teljes visszaállítás elindult — az állapot itt frissül.", false)
+	offboxRedirectTo(w, r, restoreWizardPath(app), "A teljes visszaállítás elindult — az állapot itt frissül.", false)
 }
 
 // reconstituteOutcomeMsg builds the OUTCOME flash for a completed reconstitution. Pure, so the
@@ -455,7 +464,7 @@ func (s *Server) offboxPlaceHandler(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	if s.backupMgr.IsRunning() {
-		offboxRedirectTo(w, r, "/backups/restore", "Egy mentési/visszaállítási művelet már fut.", true)
+		offboxRedirectTo(w, r, restoreWizardPath(app), "Egy mentési/visszaállítási művelet már fut.", true)
 		return
 	}
 	s.backupMgr.BeginRestoreOp("offbox-place", app)
@@ -470,7 +479,7 @@ func (s *Server) offboxPlaceHandler(w http.ResponseWriter, r *http.Request) {
 		s.logger.Printf("[INFO] [web] off-box place %s completed (async)", app)
 		s.backupMgr.EndRestoreOp(true, "A(z) "+app+" hiányzó fájljai helyreállítva az élő adatok közé.")
 	}()
-	offboxRedirectTo(w, r, "/backups/restore", "A helyreállítás elindult — az állapot itt frissül.", false)
+	offboxRedirectTo(w, r, restoreWizardPath(app), "A helyreállítás elindult — az állapot itt frissül.", false)
 }
 
 // --- R-7b: „Megosztások" restore ------------------------------------------------------------------