feat(shares): R-7b Parts 4-6 — shares restore, samba liveness, UI truth-up

Part 4 — restore: RestoreSharesScratch + PlaceSharesRestore as SIBLINGS of the
per-app scratch/place pair. Files merged missing-only (never overwriting), each
destination PREFIX-ASSERTED against registered LIVE storage roots; definitions
merged with existing-wins; ReconcileSamba via a seam (backup must not import
stacks); credential restored best-effort into the samba named volume.
New routes POST /backup/shares/{restore,place} + a restore-page entry that renders
'Megosztasok', never the raw reserved key.
Also adds scratchJoin: reconstructing an absolute captured path under a scratch
must strip the volume name rather than rely on filepath.Join.

Part 5 — liveness: EffectiveProtected gains a settings-backed dynamic extra so the
samba CONTAINER (not the stack name — they differ) is watched exactly while sharing
is on. FINDING: the issue -> health 'fail' -> existing health_critical event ->
alert -> Hungarian degradation e-mail path needs NO further change, and introduces
no new event type, so the allowlist gotcha does not apply.

Part 6 — UI: per-tier backup status lines on the Megosztas page (amber only on
deviation). Verified the two warning-prose sites (offbox_capture/tier2_capture)
only ever receive per-app stack names, so no mapping is needed there.

RED-PROOFS RUN AND REVERTED (both fired):
  4. prefix-assert removed        -> place-guard traversal test FAILS
  5. dynamic samba extra removed  -> Scenario E enabled-case FAILS

controller/internal/web/offbox_handlers.go

@@ -355,3 +355,64 @@ func (s *Server) offboxPlaceHandler(w http.ResponseWriter, r *http.Request) {
 	}()
 	offboxRedirectTo(w, r, "/backups/restore", "A helyreállítás elindult — az állapot itt frissül.", false)
 }
+
+// --- R-7b: „Megosztások" restore ------------------------------------------------------------------
+//
+// A SIBLING of the per-app restore pair above, not a special case of it: the shares source has no
+// recovery unit and no per-app toggle, so it gets its own two-step flow (restore to scratch, then a
+// deliberate place-to-live). The display name is always „Megosztások" — the reserved `_shares` key
+// never reaches a customer-facing surface.
+
+// sharesRestoreHandler restores the latest shares snapshot into an on-data-drive scratch dir
+// (POST /backup/shares/restore). Non-destructive: nothing live is touched until the place action.
+func (s *Server) sharesRestoreHandler(w http.ResponseWriter, r *http.Request) {
+	if s.backupMgr == nil || !s.backupMgr.OffboxConfigured() {
+		offboxRedirectTo(w, r, "/backups/restore", "A távoli mentési cél nincs beállítva.", true)
+		return
+	}
+	if s.backupMgr.IsRunning() {
+		offboxRedirectTo(w, r, "/backups/restore", "Egy mentési/visszaállítási művelet már fut.", true)
+		return
+	}
+	s.backupMgr.BeginRestoreOp("shares-restore", backup.SharesDisplayName)
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
+		defer cancel()
+		if err := s.backupMgr.RestoreSharesScratch(ctx); err != nil {
+			s.logger.Printf("[ERROR] [web] shares restore (async): %v", err)
+			s.backupMgr.EndRestoreOp(false, "A megosztások visszaállítása sikertelen: "+err.Error())
+			return
+		}
+		s.logger.Printf("[INFO] [web] shares restore completed (async)")
+		s.backupMgr.EndRestoreOp(true, "A megosztások visszaállítása elkészült — most helyreállíthatod az élő adatok közé.")
+	}()
+	offboxRedirectTo(w, r, "/backups/restore", "A megosztások visszaállítása elindult — az állapot itt frissül.", false)
+}
+
+// sharesPlaceHandler merges a completed shares scratch into the live share folders, re-adds the
+// missing definitions and restores the household credential (POST /backup/shares/place).
+func (s *Server) sharesPlaceHandler(w http.ResponseWriter, r *http.Request) {
+	if s.backupMgr == nil || !s.backupMgr.OffboxConfigured() {
+		offboxRedirectTo(w, r, "/backups/restore", "A távoli mentési cél nincs beállítva.", true)
+		return
+	}
+	if s.backupMgr.IsRunning() {
+		offboxRedirectTo(w, r, "/backups/restore", "Egy mentési/visszaállítási művelet már fut.", true)
+		return
+	}
+	s.backupMgr.BeginRestoreOp("shares-place", backup.SharesDisplayName)
+	go func() {
+		ctx, cancel := context.WithTimeout(context.Background(), 30*time.Minute)
+		defer cancel()
+		res, err := s.backupMgr.PlaceSharesRestore(ctx)
+		if err != nil {
+			s.logger.Printf("[ERROR] [web] shares place (async): %v", err)
+			s.backupMgr.EndRestoreOp(false, "A megosztások helyreállítása sikertelen: "+err.Error())
+			return
+		}
+		s.logger.Printf("[INFO] [web] shares place completed (async): %d file(s), %d definition(s)",
+			res.FilesRestored, len(res.DefinitionsAdded))
+		s.backupMgr.EndRestoreOp(true, res.FlashMessage())
+	}()
+	offboxRedirectTo(w, r, "/backups/restore", "A megosztások helyreállítása elindult — az állapot itt frissül.", false)
+}