feat(shares): R-7b Parts 4-6 — shares restore, samba liveness, UI truth-up

Part 4 — restore: RestoreSharesScratch + PlaceSharesRestore as SIBLINGS of the
per-app scratch/place pair. Files merged missing-only (never overwriting), each
destination PREFIX-ASSERTED against registered LIVE storage roots; definitions
merged with existing-wins; ReconcileSamba via a seam (backup must not import
stacks); credential restored best-effort into the samba named volume.
New routes POST /backup/shares/{restore,place} + a restore-page entry that renders
'Megosztasok', never the raw reserved key.
Also adds scratchJoin: reconstructing an absolute captured path under a scratch
must strip the volume name rather than rely on filepath.Join.

Part 5 — liveness: EffectiveProtected gains a settings-backed dynamic extra so the
samba CONTAINER (not the stack name — they differ) is watched exactly while sharing
is on. FINDING: the issue -> health 'fail' -> existing health_critical event ->
alert -> Hungarian degradation e-mail path needs NO further change, and introduces
no new event type, so the allowlist gotcha does not apply.

Part 6 — UI: per-tier backup status lines on the Megosztas page (amber only on
deviation). Verified the two warning-prose sites (offbox_capture/tier2_capture)
only ever receive per-app stack names, so no mapping is needed there.

RED-PROOFS RUN AND REVERTED (both fired):
  4. prefix-assert removed        -> place-guard traversal test FAILS
  5. dynamic samba extra removed  -> Scenario E enabled-case FAILS

controller/internal/web/handlers.go

@@ -815,6 +815,14 @@ func (s *Server) backupsRestoreHandler(w http.ResponseWriter, r *http.Request) {
 		}
 	}
 	data["OffboxScratchReady"] = ready
+	// R-7b: the shares source is not an app — it has no per-app toggle and no recovery unit — so it
+	// gets its own restore entry rather than a synthetic row in OffboxApps (which would also make it
+	// appear in the per-app offsite TOGGLE list on /backups/remote, where it does not belong).
+	if s.backupMgr != nil {
+		data["SharesRestoreOffered"] = s.settings != nil && len(s.settings.GetSMBShares()) > 0
+		data["SharesScratchReady"] = s.backupMgr.SharesScratchReady()
+		data["SharesDisplayName"] = backup.SharesDisplayName
+	}
 	s.executeTemplate(w, r, "backups_restore", data)
 }