v0.277.0: kept data loads from the off-site copy too (R-691 (2))

Use my kept data / Load consider the off-site snapshot when it is newer than every local copy or
the only one; the unit is downloaded alone, judged (drive, data, recorded data version) and only
then restored. The page names the copy and its date.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/api/kept_install.go

@@ -6,6 +6,7 @@ import (
 	"time"
 
 	"gitea.dooplex.hu/admin/felhom-controller/internal/appbackup"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/backup"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
 )
 
@@ -27,8 +28,9 @@ type keptChoiceData struct {
 // keptDataAtInstall answers the install when the app's private drive folder already holds data:
 //
 //   - no choice → 409 kept_data_choice with the sentences (nothing moved, nothing installed);
-//   - "use"     → a LOAD from the newest usable copy (backup.KeptDBCopy), the removed-app restore with
-//     the unit named, then the app's after_load; 202. Refused 409 with use_off when no copy exists;
+//   - "use"     → a LOAD from the newest usable copy (backup.KeptBestCopy: own unit, second drive, or —
+//     R-691 (2) — the off-site copy, downloaded unit-only at load time), then the app's after_load; 202.
+//     The page names the copy and its date. Refused 409 with use_off when no copy exists;
 //   - "fresh"   → not handled here: DeployStack moves the old data aside and installs.
 //
 // Returns true when it wrote the response.
@@ -50,14 +52,11 @@ func (r *Router) keptDataAtInstall(w http.ResponseWriter, req *http.Request, nam
 		}
 	}
 	var cp struct {
-		ok   bool
-		time time.Time
-		dir  string
+		ok bool
+		c  backup.KeptCopy
 	}
 	if r.backupMgr != nil {
-		if c, ok := r.backupMgr.KeptDBCopy(name, hdd); ok {
-			cp.ok, cp.time, cp.dir = true, c.Time, c.UnitDir
-		}
+		cp.c, cp.ok = r.backupMgr.KeptBestCopy(req.Context(), name, hdd)
 	}
 	lang := r.langFor(req)
 	data := keptChoiceData{
@@ -71,7 +70,7 @@ func (r *Router) keptDataAtInstall(w http.ResponseWriter, req *http.Request, nam
 		NotBacked:  r.msgLang(lang, "kept.not_backed_up"),
 	}
 	if cp.ok {
-		data.UseDesc = r.msgLang(lang, "kept.choice.use.desc", localDay(cp.time))
+		data.UseDesc = r.msgLang(lang, "kept.choice.use.desc_from", r.keptCopyName(lang, cp.c))
 	} else {
 		data.UseOff = r.msgLang(lang, "kept.choice.use_off")
 	}
@@ -91,8 +90,12 @@ func (r *Router) keptDataAtInstall(w http.ResponseWriter, req *http.Request, nam
 			writeJSON(w, http.StatusConflict, apiResponse{OK: false, Error: r.msgLang(lang, "api.kept.busy")})
 			return true
 		}
-		r.logger.Printf("[INFO] [api] Deploy %s: USE MY KEPT DATA — loading from %s (%s) under the kept files %v", name, cp.dir, cp.time.UTC().Format(time.RFC3339), old)
-		r.startKeptLoad(name, cp.dir, lang, nil)
+		src := cp.c.UnitDir
+		if cp.c.Tier == backup.KeptTierOffsite {
+			src = "off-site snapshot " + cp.c.SnapshotID
+		}
+		r.logger.Printf("[INFO] [api] Deploy %s: USE MY KEPT DATA — loading from %s (tier %d, %s) under the kept files %v", name, src, cp.c.Tier, cp.c.Time.UTC().Format(time.RFC3339), old)
+		r.startKeptLoad(name, hdd, cp.c, lang, nil)
 		writeJSON(w, http.StatusAccepted, apiResponse{OK: true, Message: r.msgLang(lang, "kept.load.started", display)})
 		return true
 	default:
@@ -101,34 +104,60 @@ func (r *Router) keptDataAtInstall(w http.ResponseWriter, req *http.Request, nam
 	}
 }
 
-// startKeptLoad runs the load and, when it succeeded, the app's after_load. then(ok) runs last.
-func (r *Router) startKeptLoad(name, unitDir, lang string, then func(ok bool)) {
+// keptCopyName names a copy for the household: which copy and its date („saját mentés, 2026-09-28 04:15").
+func (r *Router) keptCopyName(lang string, c backup.KeptCopy) string {
+	return r.msgLang(lang, backup.KeptCopyKey(c.Tier), localMinute(c.Time))
+}
+
+// startKeptLoad runs the load and, when it succeeded, the app's after_load. then(ok) runs last. The
+// off-site copy goes through LoadKeptOffsite (download the unit alone, judge it, then the same restore).
+func (r *Router) startKeptLoad(name, drive string, c backup.KeptCopy, lang string, then func(ok bool)) {
 	display := name
 	if st, ok := r.stackMgr.GetStack(name); ok && st.Meta.DisplayName != "" {
 		display = st.Meta.DisplayName
 	}
-	r.backupMgr.LoadKeptApp(name, unitDir,
-		func(error) string { return r.msgLang(lang, "kept.load.done", display) },
-		func(err error) string { return r.msgLang(lang, "kept.load.failed", display, err) },
-		func(ok bool) {
-			if ok {
-				if ran, err := r.stackMgr.RunAfterLoad(name, 10*time.Minute); ran && err != nil {
-					r.logger.Printf("[WARN] [api] kept load %s: after_load failed: %v", name, err)
-				}
+	okMsg := func(error) string { return r.msgLang(lang, "kept.load.done", display) }
+	failMsg := func(err error) string { return r.msgLang(lang, "kept.load.failed", display, err) }
+	if c.Tier == backup.KeptTierOffsite {
+		r.backupMgr.LoadKeptOffsite(name, drive, c, nil, okMsg, failMsg, r.keptAfterLoad(name, then))
+		return
+	}
+	r.backupMgr.LoadKeptApp(name, c.UnitDir, okMsg, failMsg, r.keptAfterLoad(name, then))
+}
+
+// keptAfterLoad runs the app's after_load when the load succeeded, then then(ok).
+func (r *Router) keptAfterLoad(name string, then func(ok bool)) func(ok bool) {
+	return func(ok bool) {
+		if ok {
+			if ran, err := r.stackMgr.RunAfterLoad(name, 10*time.Minute); ran && err != nil {
+				r.logger.Printf("[WARN] [api] kept load %s: after_load failed: %v", name, err)
 			}
-			if then != nil {
-				then(ok)
-			}
-		})
+		}
+		if then != nil {
+			then(ok)
+		}
+	}
 }
 
 func localDay(t time.Time) string {
 	if t.IsZero() {
 		return "?"
 	}
+	return t.In(budapest()).Format("2006-01-02")
+}
+
+// localMinute is localDay with the time of day — the kept list's format, so both pages print one date.
+func localMinute(t time.Time) string {
+	if t.IsZero() {
+		return "?"
+	}
+	return t.In(budapest()).Format("2006-01-02 15:04")
+}
+
+func budapest() *time.Location {
 	loc, err := time.LoadLocation("Europe/Budapest")
 	if err != nil {
-		loc = time.UTC
+		return time.UTC
 	}
-	return t.In(loc).Format("2006-01-02")
+	return loc
 }