catalog: the lifecycle implementation itself (fixes the previous commit)

The previous commit landed only the new test/badge files: a 'git stash' used
to compare REUSE.md ref-check output silently dropped the staged index, so
every modification to an existing file was left behind and that commit does
not build. This adds the metadata field, the predicates, the fail-closed
deploy gate, the catalog filter, the funcmap entries, the template edits and
the docs that those tests exercise.

controller/internal/stacks/deploy.go

@@ -160,6 +160,16 @@ func (m *Manager) DeployStack(req DeployRequest) (string, error) {
 	stackDir := filepath.Dir(stack.ComposePath)
 	meta := LoadMetadata(stackDir)
 
+	// --- Lifecycle gate (defence in depth) ---
+	// The API handler refuses this first, with the customer-facing Hungarian message. This second
+	// check exists because DeployStack is the manager-level choke point EVERY caller goes through,
+	// and metadata is already loaded here — so a future caller that does not route through the API
+	// cannot bypass the rule by simply not knowing about it. Deliberately before the first mutation.
+	if !meta.CanInstall() {
+		clearDeploying()
+		return "", fmt.Errorf("stack %q is not installable (lifecycle: %s)", req.StackName, meta.EffectiveLifecycle())
+	}
+
 	// --- Memory validation ---
 	var deployWarning string
 	reservedMB := m.cfg.System.ReservedMemoryMB

controller/internal/stacks/metadata.go

@@ -17,6 +17,16 @@ type Metadata struct {
 	Category    string `yaml:"category" json:"category"`
 	Subdomain   string `yaml:"subdomain" json:"subdomain"`
 	Slug        string `yaml:"slug" json:"slug"`
+	// Lifecycle governs whether this app is OFFERED for new installs. It never affects an app that
+	// is already deployed — a customer running a hidden or abandoned app keeps full function, which
+	// is the whole point: removing a template from the catalog would orphan them instead.
+	//   ""/"available" — normal.
+	//   "hidden"       — not offered for new installs. No explanation owed.
+	//   "abandoned"    — not offered for new installs, AND every box already running it shows a
+	//                    permanent notice that updates and security fixes will no longer arrive.
+	// An UNKNOWN value degrades to available with one WARN (see LoadMetadata) — a typo in a catalog
+	// push must never brick a template.
+	Lifecycle string `yaml:"lifecycle,omitempty" json:"lifecycle,omitempty"`
 	// OpenPath is appended to the app's public URL for the "Megnyitás" (open) link, for apps whose UI
 	// isn't at "/" (e.g. Gokapi → "/admin"). Empty = bare root. Must start with "/".
 	OpenPath       string                `yaml:"open_path,omitempty" json:"open_path,omitempty"`
@@ -193,6 +203,44 @@ type HealthCheckExpect struct {
 	BodyContains string `yaml:"body_contains" json:"body_contains"` // string that must appear in response body
 }
 
+// Lifecycle values. Absent/empty ≡ LifecycleAvailable.
+const (
+	LifecycleAvailable = "available"
+	LifecycleHidden    = "hidden"
+	LifecycleAbandoned = "abandoned"
+)
+
+// EffectiveLifecycle normalises Metadata.Lifecycle. It is the SINGLE definition of "what state is
+// this app in" — every caller (catalog listing, deploy gate, badge, notice) must go through it, so
+// an unknown value can only ever be interpreted one way.
+//
+// Fail-OPEN is deliberate here, and it is the opposite of the deploy gate's posture on purpose:
+// an unrecognised value means the catalog is newer than this controller, and the safe reading of
+// "I do not know what this state is" is "leave the app alone" — the alternative would let a typo,
+// or a state added in a later release, silently pull a working app out of every customer's catalog.
+// The gate that actually protects against installing something is `CanInstall`, and it is fed by
+// this same function, so the two can never disagree.
+func (m *Metadata) EffectiveLifecycle() string {
+	switch m.Lifecycle {
+	case "", LifecycleAvailable:
+		return LifecycleAvailable
+	case LifecycleHidden:
+		return LifecycleHidden
+	case LifecycleAbandoned:
+		return LifecycleAbandoned
+	default:
+		return LifecycleAvailable
+	}
+}
+
+// CanInstall reports whether this app may be offered/installed. The catalog listing and the deploy
+// endpoint MUST both use this — a template excluded from the list but accepted by a direct POST
+// would be a gate in name only.
+func (m *Metadata) CanInstall() bool { return m.EffectiveLifecycle() == LifecycleAvailable }
+
+// IsAbandoned reports whether a DEPLOYED instance should carry the "no longer maintained" notice.
+func (m *Metadata) IsAbandoned() bool { return m.EffectiveLifecycle() == LifecycleAbandoned }
+
 // LoadMetadata reads .felhom.yml from a stack directory.
 // Returns default metadata if the file doesn't exist.
 func LoadMetadata(stackDir string) Metadata {
@@ -229,6 +277,14 @@ func LoadMetadata(stackDir string) Metadata {
 		meta.Category = "tools"
 	}
 
+	// Lifecycle: warn ONCE on an unrecognised value, then let EffectiveLifecycle degrade it to
+	// available. Logged here rather than in EffectiveLifecycle because that is called on every
+	// render — this is the one place per load, so a typo is visible without flooding the log.
+	if meta.Lifecycle != "" && meta.EffectiveLifecycle() == LifecycleAvailable && meta.Lifecycle != LifecycleAvailable {
+		log.Printf("[WARN] [stacks] %s: unknown lifecycle %q in .felhom.yml — treating as %q (known: %s, %s, %s)",
+			dirName, meta.Lifecycle, LifecycleAvailable, LifecycleAvailable, LifecycleHidden, LifecycleAbandoned)
+	}
+
 	// Default healthcheck fields
 	if meta.HealthCheck != nil {
 		if meta.HealthCheck.Interval == "" {