v0.155.0 — the restore wizard read the wrong "is something running" flag

Fixes a defect shipped in v0.154.0, found by the operator on the first live
click-through of the new wizard.

backup.Manager carries TWO running booleans. `running` (read by IsRunning) is the
concurrency single-flight, acquired inside the background goroutine — and
RestoreOffboxScratch never acquires it at all. `opRunning` (read by RestoreStatus) is the
display flag, set synchronously by BeginRestoreOp in the handler.

The wizard sourced OpRunning from IsRunning(), so for „Ellenőrzés" and the full-restore
preparation — its two most-used and longest actions, both streaming from restic — the
execution step was unreachable: the page offered all three intents with live buttons
while a restore was running, and the progress banner contradicted the phase strip on the
same screen. Pressing anything there would have been refused by the handler, which is the
exact "offering a control guaranteed to fail" dishonesty R-48 exists to remove.

Fix: restoreOpInFlight(st) behind a documented seam, fed by a SINGLE RestoreStatus() read
per render so the strip, the suppression decision and the running-op name cannot diverge.

Why the tests missed it: the Scenario-E table proved deriveWizardStep behaves correctly
GIVEN OpRunning=true, but nothing proved the handler ever computes true — hollow at
exactly that seam. TestRestoreOpInFlight_UsesDisplayFlagNotConcurrencyFlag now drives a
real Manager through BeginRestoreOp and asserts the render suppresses every form.
Red-proofed against the v0.154.0 shape.

Also: „Eredmény" was a dead label. The strip's highlight is now its own derived Phase,
separate from Step — a finished restore returns to the intent step (everything available
again) while the strip reads „Eredmény" and an outcome card shows the result. Bounded by
restoreResultWindow (10 min) so a stale result cannot look fresh, and bound to the app so
a finished bookstack restore does not light immich's page with bookstack's message. The
card survives a reload; the redirect flash does not.

No new agent coupling — MinAgent stays 0.90.0.

controller/README.md

@@ -326,6 +326,12 @@ Each app can define rich metadata in `.felhom.yml`:
     `?full_prep=`, so no commit button survives into a restore. While ANY op runs, every mutation
     form is suppressed server-side rather than offered and refused. No new endpoint, no job registry
     (that stays R-45), and the page works with JavaScript disabled.
+    **v0.155.0 fix:** the "is an op running" read must come from `RestoreStatus()` (the `opRunning`
+    display flag, set synchronously by `BeginRestoreOp`), NOT `Manager.IsRunning()` (the concurrency
+    single-flight, which `RestoreOffboxScratch` never acquires — so v0.154.0's execution step was
+    unreachable for the verification restore). The strip's highlight is its own derived `Phase`, so a
+    finished restore reads „Eredmény" while the intent step is available again; the outcome card is
+    window-bounded and app-bound.
   - **The DB-only replay window (v0.153.0, R-47).** Until v0.153.0 the whole stack was started before
     the replay, so the application's own schema management raced the dump: measured live on
     2026-07-19 (H4), immich-server rebuilt `clip_index` two seconds before the dump's `CREATE INDEX`