controller v0.267.0: tests off DooPlex's Docker, cut-off copies refused, two pages true

R-650: internal/dockerexec — every docker exec routed through it; under
go test a real docker is refused (opt-in FELHOM_TEST_REAL_DOCKER=1; a stub
under the temp dir is allowed). api/stacks/web tests run under a silent
stub (TestMain). TestR650_NoBareDockerExec pins it repo-wide.
R-640: a dump without its engine's completion marker is refused before
the first mutation (unit + off-site restore) and again before any load.
R-499: the Tier-2 page's system-disk sentence has four true branches.
R-518: the backup button states the measured ~8 min stop.
R-626: measured on 9202, not reproduced.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/appexport/restore.go

@@ -5,6 +5,7 @@ import (
 	"compress/gzip"
 	"context"
 	"fmt"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/dockerexec"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/util"
 	"io"
 	"os"
@@ -941,7 +942,7 @@ func composeExecEnv(stackDir string, env map[string]string, args ...string) ([]b
 	ctx, cancel := context.WithTimeout(context.Background(), 5*time.Minute)
 	defer cancel()
 
-	cmd := exec.CommandContext(ctx, "docker", cmdArgs...)
+	cmd := dockerexec.CommandContext(ctx, "docker", cmdArgs...)
 	cmd.Dir = stackDir
 	cmd.Env = os.Environ()
 	for k, v := range env {
@@ -989,14 +990,14 @@ func waitForDB(containerID, dbType string, env map[string]string) error {
 			if user == "" {
 				user = "postgres"
 			}
-			cmd = exec.CommandContext(ctx, "docker", "exec", containerID,
+			cmd = dockerexec.CommandContext(ctx, "docker", "exec", containerID,
 				"pg_isready", "-U", user)
 		case "mariadb":
 			password := env["MYSQL_ROOT_PASSWORD"]
 			if password == "" {
 				password = env["MARIADB_ROOT_PASSWORD"]
 			}
-			cmd = exec.CommandContext(ctx, "docker", "exec", containerID,
+			cmd = dockerexec.CommandContext(ctx, "docker", "exec", containerID,
 				"mysqladmin", "ping", "-u", "root", "-p"+password)
 		default:
 			cancel()
@@ -1047,7 +1048,7 @@ func importDBDump(containerID, dumpPath, dbType string, env map[string]string) e
 		if dbName == "" {
 			dbName = user
 		}
-		cmd = exec.CommandContext(ctx, "docker", "exec", "-i", containerID,
+		cmd = dockerexec.CommandContext(ctx, "docker", "exec", "-i", containerID,
 			"psql", "-U", user, "-d", dbName)
 	case "mariadb":
 		password := env["MYSQL_ROOT_PASSWORD"]
@@ -1058,7 +1059,7 @@ func importDBDump(containerID, dumpPath, dbType string, env map[string]string) e
 		if dbName == "" {
 			dbName = env["MARIADB_DATABASE"]
 		}
-		cmd = exec.CommandContext(ctx, "docker", "exec", "-i", containerID,
+		cmd = dockerexec.CommandContext(ctx, "docker", "exec", "-i", containerID,
 			"mysql", "-u", "root", "-p"+password, dbName)
 	default:
 		return fmt.Errorf("unknown DB type: %s", dbType)