v0.207.0 — R-249: the retrieval passphrase leaves the page body; R-252/R-253: two refusals learn to say what to do

R-249. settings_security.html rendered the passphrase into a display:none
span behind a Megjelenit button. That toggle stops a browser DRAWING the value
and nothing else — the plaintext was in the response body of every render, so a
curl of the page returned it. Found by exactly that: it landed in a session
transcript while driving the documented rebuild path.

The codebase already stated this rule for the recovery code and this page did not
follow it (escrow_handlers.go: 'reveal (claim XHR only — R is NEVER templated
server-side into HTML)'). The page now carries only HasRetrievalPassword; the
value comes from POST /settings/retrieval-password/reveal — CSRF-covered because
POST, no-store, and LOGGED as an act, which reading it off the markup never was.

The tests assert the RAW RESPONSE BODY. Every test that asked what the customer
sees passed while the bytes carried the secret; that is why this survived.

Census: the render-then-hide pattern appears twice more — app_info.html (a real
per-install app password in a hidden span) and deploy.html. Filed as R-254, NOT
fixed here.

R-252. A rebuilt box keeps its drives but loses their REGISTRATION. The restore
page now states that before the customer presses anything, says the backups and
drives are both still there, and links to Tarhely > Meghajtok. Page and resolver
ask ONE question — HasRestoreDestination() reads the same
GetSchedulableStoragePaths() the scratch resolver reads.

R-253. The list promised 'a visszaallitas elobb ujratelepiti' three lines above a
refusal that fired BECAUSE the app was not installed. The promise was the wrong
half: reconstitution writes to the app's own GetStackHDDPath, which exists only
once the CUSTOMER has chosen a drive at deploy time. Auto-reinstalling would mean
the product making that choice for them. Copy now says to install first and routes
to /stacks/<app>/deploy.

Both notices are conditional — a healthy box renders as before, pinned by a test
that fails if either becomes unconditional.

controller/internal/web/templates/backups_restore.html

@@ -69,6 +69,16 @@
     <!-- R-237: driven by what is IN THE STORE, not by what is deployed and toggled. A rebuilt box has
          neither and used to be told there was nothing to restore, while its snapshots sat in the
          repository the whole time. Installed-ness is a property OF a row, never a filter on it. -->
+    <!-- R-252: the precondition a rebuilt box fails, said BEFORE the customer presses a button that
+         would refuse. Rendered only when it is true — a healthy box sees nothing new here. -->
+    {{if .NoRestoreDestination}}
+    <p class="form-hint" style="border-left:2px solid var(--amber);padding-left:.75rem">
+        <strong>Előbb csatold vissza az adatmeghajtót.</strong> A mentéseid megvannak, és a meghajtók is
+        megvannak — újratelepítés után viszont a gép még nem ismeri őket, ezért most nincs hová
+        visszaállítani. Ez két kattintás: <a href="/storage" style="color:var(--blue)">Tárhely →
+        Meghajtók</a>, „Meglévő meghajtó csatolása". Utána gyere vissza ide.
+    </p>
+    {{end}}
     {{if eq .OffsiteStoreState "unreadable"}}
     <p class="form-hint">Nem tudjuk elolvasni a távoli tárolót, ezért <strong>nem tudjuk, mi van benne</strong>. Ez nem azt jelenti, hogy üres — próbáld újra később, vagy jelezd az üzemeltetőnek.</p>
     {{else if eq .OffsiteStoreState "no-target"}}
@@ -79,8 +89,16 @@
         {{range .OffsiteRestoreRows}}
         {{template "app_list_row" dict "Slug" .Slug "Name" .DisplayName}}
             {{if .Restorable}}
+                <!-- R-253: this row used to promise that the restore would reinstall the app first.
+                     It cannot: reconstitution writes to the app's OWN data path (GetStackHDDPath),
+                     which exists only once the customer has chosen a drive during deploy — the
+                     restore has no answer to that question and must not invent one. The copy now
+                     says what the handler does and routes to the place that does it. (The old
+                     sentence is deliberately NOT quoted here: an HTML comment ships in the response
+                     body, so quoting it would keep the contradiction on the page and would make the
+                     test that forbids it unfailable.) -->
                 {{if and .InStore (not .Installed)}}
-                <span class="form-hint" style="margin-right:.5rem">Nincs telepítve — a visszaállítás előbb újratelepíti.</span>
+                <span class="form-hint" style="margin-right:.5rem">Nincs telepítve — előbb <a href="/stacks/{{.App}}/deploy" style="color:var(--blue)">telepítsd újra</a>, utána hozhatod vissza az adatait.</span>
                 {{end}}
                 {{if .StoreUnknown}}
                 <span class="form-hint" style="margin-right:.5rem">Nem tudjuk, van-e mentése — a tárolót nem sikerült elolvasni.</span>