docs: v0.100.0 — CHANGELOG/CONTEXT/REUSE/README for the Tier-2 in-place file restore (F2 closed)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/README.md

@@ -477,6 +477,21 @@ reach bind mounts). Auto-targeted: **prefer another registered user-data drive**
 `settings.CrossDriveBackup` and drives the "2. mentés" card. Runs daily (`tier2-backup`, 03:30) or via
 `POST /api/backup/tier2`. restic is **not** used — a plain browsable mirror.
 
+**In-place file restore from the Tier-2 copy (C2, v0.100.0 — closes drill finding F2)** —
+`POST /backup/tier2/restore` (`backup.RestoreTier2Files`, `internal/backup/tier2_restore.go`) + the
+**"Fájlok visszaállítása"** button on the healthy Tier-2 layer row. **Additive-only** semantics
+(`rsyncRestoreMissing`: `rsync -a --ignore-existing`): files missing from the live `appdata/<stack>`
+are copied back from the RECORDED Tier-2 copy; existing live files are **never overwritten** (a
+customer edit after the last copy wins) and **nothing is ever deleted** — this exactly serves the
+"I deleted my files" scenario with zero risk to newer data. Source = the recorded
+`CrossDriveBackup.DestinationPath` (never a fresh target selection). Single-flight with
+backup/restore; refusals (no copy / never ran / copy dir gone / either drive disconnected /
+decommissioned) happen before the app is stopped, with customer-readable Hungarian reasons;
+stop → copy → start → health-wait; zero files copied is a success ("Nincs hiányzó fájl…"). Out of
+scope by design: overwrite/point-in-time restore (offbox + operator paths), per-file selection,
+`recovery-unit/`. Apps that index their data dir (e.g. Nextcloud) may need a rescan (occ
+files:scan) before restored files appear in their own UI.
+
 **Per-app Tier-2 config panel (v0.57.0)** — `GET/POST /stacks/{name}/backup`
 (`internal/web/tier2_config_handler.go` + `templates/tier2_config.html`). The "2. mentés" row's
 **Beállítás** button links here (was the dead-end deploy page). Shows the effective off-drive target