v0.214.0 — the recovery screen stops hedging about a code it can now check (R-311)

MinAgent: 0.129.0

What was already right: the screen did not bluntly accuse. R-222/R-226 hedged,
naming both causes and the kept package, and saying it could not tell them apart.
That was honest - and it could not tell them apart because nothing ever looked.
Agent v0.129.0 looks, so the hedge becomes an answer.

New class RecoveryCodeOpensRetained on HTTP 422, gated by
FeatureRetainedRecoveryClass (MinAgent 0.129.0). The gate is SEPARATE from the
R-224 one because the two name different agent versions and a box can sit between
them, where a 422 is a shape we did not design. ClassifyRecoveryFailure therefore
takes both flags; the compiler found every call site.

The message says the code is correct, names the supersession date, says the
earlier package is kept, and says the CURRENT backups are unaffected - the half a
customer will otherwise assume wrong. It promises NO restore: there is no
in-product route to a set-aside store (R-312) and the retained package may itself
predate the repository-password field. It routes to support, which can do it.

The claim guard grew a surface and immediately convicted something. It scanned
templates only, while every recovery message is a Go string in a handler - the
highest-stakes copy in the product, never scanned. It now scans recovery_handlers.go
too, and found a PRE-EXISTING unregistered claim on its first run.

Six handler tests asserting which SENTENCE the customer sees; red-proofs asserted
applied, including: 422 unconditional makes an agent that never looked read as
having looked, and routing 400 to the new class congratulates a mistype.

controller/README.md

@@ -200,6 +200,14 @@ backups, monitoring and notifications. All Proxmox/disk operations are delegated
   per-visit, the durable opt-out silences the bar only, and **none of the three removes the entry
   point on Távoli mentés**. While a recovery is outstanding, „Helyreállítási kód létrehozása" is
   UNAVAILABLE — creating a new code would put the earlier history beyond every shipped path.
+  **A code for an EARLIER package is now recognised as correct (v0.214.0, R-311; MinAgent 0.129.0).**
+  When the supplied code does not open the package the hub currently holds, the agent tries the
+  RETAINED ones and answers 422 if one opens; the screen then says the code is *correct*, names the
+  supersession date, says the earlier package is kept and that the CURRENT backups are unaffected, and
+  routes to support. It deliberately promises **no restore** — there is no in-product route to a
+  set-aside store (R-312), and the retained package may itself predate the repository-password field.
+  On an agent older than 0.129.0 the screen keeps the earlier hedged wording, which was honest: until
+  something looked, a correct-but-earlier code and a mistype really were indistinguishable.
   (traefik/cloudflared/filebrowser) get curated Hungarian display identity from the
   `inframeta.go` map (name + description + generic `/static/infra-logo.svg` fallback icon);
   filebrowser is the only infra stack with a customer link (`files.<domain>`).