clear_hold (D64 = B) + the box command through the running controller (R-1343), R-1340, R-1341 — tests red first; commit only

- clear_hold: a fifth verb in the closed operator-action list; lifts a hold of any reason in the RUNNING
  controller (memory + settings.json together), forgets the update's held flag, drops a waiting put-back
  from the app-stop marker (copy kept). Refused on a bad name or no hold. No new event type.
- --clear-restore-hold asks the running controller over <data dir>/ctl/hold.sock (unix, 0600, peer uid
  checked, no TCP); edits settings.json only when no controller answers, and says so (in-guest restart).
- R-1340: the operator's HELD STOPPED mail is built from the hold record (restore kind, mixed cause,
  failed put-back step, database replay or not, kept copy) — never the option-C database story by default.
- R-1341: the OOM WARN line once per new kill (container, start time, kill count); event unchanged.

controller/cmd/controller/oomlog.go

@@ -0,0 +1,43 @@
+package main
+
+import (
+	"strconv"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
+)
+
+// ── R-1341: the OOM line is logged once per NEW kill ──────────────────────────────────────────────────────────────
+//
+// ScanOOMKilled reports a container for as long as it lives after a kill (Docker's OOMKilled flag is sticky, and the
+// kernel's kill counter never goes down), so the 30-s dead-app scan logged „[WARN] [deadapp] … was OOM-killed" about
+// 2 880 times a day per container — measured 2026-10-29 on Tester 1 — while the notifier's cooldown kept the event to
+// one. The line now goes out when the kill is NEW: the key is (container, its start time, the kill count), and a line
+// is logged only when a container's key changes — a second scan of the same kill logs nothing, a new kill (the count
+// went up) or a restarted container (a new start time) logs again. The event call is unchanged (every scan, the
+// notifier decides). Pinned by TestR1341_*.
+
+// oomLogGate remembers the last logged key per container. Not safe for concurrent use: the dead-app job runs serially.
+type oomLogGate struct {
+	last map[string]string
+}
+
+func oomLogKey(o stacks.OOMContainer) string {
+	return o.StartedAt + "|" + strconv.FormatInt(o.Kills, 10)
+}
+
+// fresh returns the containers whose kill is new since the last scan, and remembers this scan's keys. A container
+// absent from this scan is forgotten (it was removed or restarted clean), which also bounds the memory.
+func (g *oomLogGate) fresh(ooms []stacks.OOMContainer) []stacks.OOMContainer {
+	next := make(map[string]string, len(ooms))
+	var out []stacks.OOMContainer
+	for _, o := range ooms {
+		k := oomLogKey(o)
+		next[o.Container] = k
+		if prev, ok := g.last[o.Container]; ok && prev == k {
+			continue
+		}
+		out = append(out, o)
+	}
+	g.last = next
+	return out
+}