v0.58.0: infra-protection prevention layer for the OS/Docker-data split (Phase 2)

Reserved-buffer headroom guard on the Docker-data volume (system/dockervol.go,
max(5GB,10%)); deploy-time hard gate refuses (HTTP 507) when below the buffer
(api/router.go); deploy page warns + disables the button (deploy.html); runtime
disk monitor confirmed to watch the Docker volume above the buffer. Log rotation
baked into the golden (agent side). Phase 1 = felhom-agent v0.29.0.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/web/handlers.go

@@ -332,6 +332,17 @@ func (s *Server) deployHandler(w http.ResponseWriter, r *http.Request, name stri
 	}
 	data["StoragePaths"] = deployPaths
 
+	// Prevention layer (storage-split): surface the Docker-data volume's reserved-buffer state so the
+	// customer sees BEFORE deploying when free space is too low (the API gate also hard-refuses). Only
+	// meaningful for a NEW deploy (an existing app's config save doesn't consume fresh image space).
+	if !alreadyDeployed {
+		if hr := system.GetDockerVolumeHeadroom(); hr.OK {
+			data["DockerBelowReserve"] = hr.BelowReserve
+			data["DockerFreeHuman"] = formatFreeSpace(hr.AvailGB)
+			data["DockerReserveHuman"] = formatFreeSpace(hr.ReserveGB)
+		}
+	}
+
 	// Effective subdomain for "Megnyitás" button
 	if alreadyDeployed && appCfg != nil {
 		if sd, ok := appCfg.Env["SUBDOMAIN"]; ok && sd != "" {