v0.311.0: after a power cut, an app repairs the files the cut left empty; the household sees lost photos (R-1007)

New template block after_unclean_boot (decision 236): once per controller start that followed an
UNCLEAN host boot (crashboot's own verdict, after the 15-minute crash grace; a normal or unknown boot
never runs it), each app with the block rebuilds ONLY its zero-byte files (scan: regular files, no
symlinks, its own filesystem; ids appended to the app's own command in batches; one retry, then
reported) and its own lost-file check is read. The household sees lost files (name, date taken) on
the app page until dismissed; the operator gets app_repaired_after_crash with counts only. Skips,
with the reason, an unproven image, an unknown key, an app not running. MinAgent 0.155.0 unchanged.
Tests red-proofed (14 guards). One new parity fixture (the new card only).

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

controller/internal/web/handlers.go

@@ -774,6 +774,11 @@ func (s *Server) appDetailHandler(w http.ResponseWriter, r *http.Request, slug s
 	// v0.279.0 (decision 45): the default-login card only while that login is in effect.
 	data["KnownLoginLine"] = s.knownLoginLine(s.langFor(r), &found.Meta, found.AppConfig, found.Deployed)
 	data["DefaultLoginReplaced"] = defaultLoginReplaced(&found.Meta, found.AppConfig, found.Deployed)
+	// R-1007 (decision 236): the files the app's own check reported LOST after an unclean boot — the household can
+	// upload them again from the phone. Shown until dismissed; repaired previews need no note.
+	if lost, at := lostFilesNote(found.Deployed, found.AppConfig); len(lost) > 0 {
+		data["LostFiles"], data["LostBootAt"] = lost, at
+	}
 	// v0.280.0 (decision 46): the setup gate's card, while the gate stands.
 	data["SetupGateClosed"] = found.Deployed && found.AppConfig != nil && found.AppConfig.SetupGate.Closed()
 	data["SetupGateHasProbe"] = found.Meta.SetupDoneProbe != nil && found.Meta.SetupDoneProbe.URL != ""