v0.277.0: kept data loads from the off-site copy too (R-691 (2))

Use my kept data / Load consider the off-site snapshot when it is newer than every local copy or
the only one; the unit is downloaded alone, judged (drive, data, recorded data version) and only
then restored. The page names the copy and its date.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -1892,6 +1892,11 @@ that folder is never a dead end, and an install never runs into it silently (R-6
     app's data and was taken of THIS drive (the app's own unit, Tier 1, or a second-drive mirror, Tier 2 —
     `backup.KeptDBCopy`), through the one unit-restore body (`RestoreFromRecoveryUnitAt`); then the template's
     `after_load:` once. Refused 409 with the `use_off` sentence when no such copy exists.
+    **Since v0.277.0 (R-691 (2)) the off-site copy counts too** (`backup.KeptBestCopy`): its newest snapshot, when it
+    holds the app's unit and is NEWER than every local copy (or is the only one). The choice names the copy and its
+    date (`kept.choice.use.desc_from` + `kept.backup.own|second|offsite`). The load (`LoadKeptOffsite`) downloads the
+    unit ALONE into the proof scratch, refuses a unit of another drive, with no data, or whose data version is not
+    recorded (`07` §6.6), and only then restores it; the downloaded copy is removed on every path.
   - `fresh` — **„Tiszta lappal kezdem" / "Start fresh"**: the old folder is MOVED (a rename on the same drive;
     EXDEV or any failure puts back what moved and refuses) to `<drive>/kept/<app>/<YYYY-MM-DD_hhmmss>/` with a
     `.felhom-kept.json` marker; the removed app's own unit moves in with it (`kept/.../unit`) so the files keep
@@ -1899,8 +1904,9 @@ that folder is never a dead end, and an install never runs into it silently (R-6
   - no choice → `DeployStack` refuses too (`ErrKeptDataChoice`), before any write.
 - **„Megőrzött adatok" / "Kept data"** — `GET /kept-data` (linked from Tárhely → Meghajtók): every dated kept
   folder and every non-empty `appdata/<x>` no installed app binds, on every connected local drive — app, date,
-  size, which copy can bring it back (or none). **Load** (`POST /kept-data/load`, only with a copy; puts a dated
-  item's files back first, refuses over an occupied folder), **Look** (the file browser), **Delete**
+  size, which copy can bring it back (or none; since v0.277.0 also „távoli mentés, <date>" — one repository call per
+  page). **Load** (`POST /kept-data/load`, only with a copy; puts a dated item's files back first — for the off-site
+  copy only after its unit is downloaded and judged — refuses over an occupied folder), **Look** (the file browser), **Delete**
   (`POST /kept-data/delete`, the app's name typed to confirm — the ONLY deletion of kept data; the box never
   deletes one by itself, D3 is open).
 - **Read-only view.** FileBrowser gets a source „Megőrzött adatok" / "Kept data" (box language) at