docs: v0.100.0 — CHANGELOG/CONTEXT/REUSE/README for the Tier-2 in-place file restore (F2 closed)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CHANGELOG.md

@@ -1,5 +1,37 @@
 ## Changelog
 
+### v0.100.0 — one-click class-C file restore from the Tier-2 copy (2026-07-05)
+
+TASK C2 — closes drill finding **F2** (`DRILL-appdata-restore-2026-07-04.md` §4): HDD bind-mount
+user files (`appdata/<stack>`) had no customer recovery path — Tier-2 protected them nightly, but
+getting deleted files back was an operator copy-back by hand.
+
+- **Engine** (`internal/backup/tier2_restore.go`): `Manager.RestoreTier2Files(stack)` — in-place,
+  **additive-only** restore from the RECORDED Tier-2 copy (`CrossDriveBackup.DestinationPath`, never
+  a fresh `selectTier2Target`). Semantics = `rsync -a --ignore-existing`: files missing live are
+  copied back; existing live files are NEVER overwritten (a customer edit after the last copy wins);
+  nothing is EVER deleted (the `rsyncMirror --delete` trap in this direction would erase every file
+  created since last night — the new `rsyncRestoreMissing` copies the mirror's exec shape with the
+  opposite-direction flags). Single-flight with backup/restore; all refusals (no copy / LastRun
+  empty / copy dir gone / either drive disconnected / live drive decommissioned) happen BEFORE the
+  stop, with customer-readable Hungarian reasons; stop → copy → start → health; copy/restart errors
+  surface (F17). File count from `--itemize-changes` (`>f` lines); file names never logged at INFO.
+- **Endpoint + UI**: `POST /backup/tier2/restore` (`internal/web/server.go` + `handlers.go`,
+  backupRestoreHandler-shaped guards) + a **"Fájlok visszaállítása"** button on the healthy Tier-2
+  layer row (`templates/backups.html`; hidden when unconfigured / never ran / target drive
+  disconnected/inactive) with a confirm dialog stating the additive-only contract + last-copy time.
+  Zero files copied = success ("Nincs hiányzó fájl — minden fájl megvan a helyén."), not an error.
+- Out of scope by design: overwrite/point-in-time restore (offbox + operator paths), per-file
+  selection, `recovery-unit/` (backup artifacts are not user files). Apps that index their data dir
+  (e.g. Nextcloud) may need a rescan before restored files appear in their own UI — noted in
+  `felhom.eu/documentation/controller/backup-architecture.md`.
+- Tests: orchestration via a `restoreFilesCopier` seam (stop→copy→start order, src/dst contract,
+  refusal NON-effects: never stopped, copier never invoked), Scenario-D zero-copy success, itemize
+  parsing, handler guards, and an FS-level semantics test of the real rsync (LookPath-skipped where
+  rsync is absent). Companion red-proof: swapping the flags for `rsyncMirror`'s mirrors the backup
+  over live — the differing live file gets clobbered AND the live-only file gets deleted (both
+  assertions red; verified on the build server, reverted).
+
 ### v0.99.0 — restore-path fixes: dead restore UI + volume dumps + blank-secret redeploy (2026-07-05)
 
 TASK C1 — fixes F1/F3/O4 from the 2026-07-04 restore drill