v0.155.0 — the restore wizard read the wrong "is something running" flag

Fixes a defect shipped in v0.154.0, found by the operator on the first live
click-through of the new wizard.

backup.Manager carries TWO running booleans. `running` (read by IsRunning) is the
concurrency single-flight, acquired inside the background goroutine — and
RestoreOffboxScratch never acquires it at all. `opRunning` (read by RestoreStatus) is the
display flag, set synchronously by BeginRestoreOp in the handler.

The wizard sourced OpRunning from IsRunning(), so for „Ellenőrzés" and the full-restore
preparation — its two most-used and longest actions, both streaming from restic — the
execution step was unreachable: the page offered all three intents with live buttons
while a restore was running, and the progress banner contradicted the phase strip on the
same screen. Pressing anything there would have been refused by the handler, which is the
exact "offering a control guaranteed to fail" dishonesty R-48 exists to remove.

Fix: restoreOpInFlight(st) behind a documented seam, fed by a SINGLE RestoreStatus() read
per render so the strip, the suppression decision and the running-op name cannot diverge.

Why the tests missed it: the Scenario-E table proved deriveWizardStep behaves correctly
GIVEN OpRunning=true, but nothing proved the handler ever computes true — hollow at
exactly that seam. TestRestoreOpInFlight_UsesDisplayFlagNotConcurrencyFlag now drives a
real Manager through BeginRestoreOp and asserts the render suppresses every form.
Red-proofed against the v0.154.0 shape.

Also: „Eredmény" was a dead label. The strip's highlight is now its own derived Phase,
separate from Step — a finished restore returns to the intent step (everything available
again) while the strip reads „Eredmény" and an outcome card shows the result. Bounded by
restoreResultWindow (10 min) so a stale result cannot look fresh, and bound to the app so
a finished bookstack restore does not light immich's page with bookstack's message. The
card survives a reload; the redirect flash does not.

No new agent coupling — MinAgent stays 0.90.0.

controller/internal/web/templates/backups_restore_wizard.html

@@ -20,13 +20,24 @@
 <!-- Phase strip: the customer can see there IS a sequence, and where they are in it. The round-2
      incident's second half was that the decisive step appeared only after the first was pressed,
      with nothing signposting that a second step existed at all. -->
+{{$phase := printf "%s" .Wizard.Phase}}
 <div class="restore-wizard-phases">
-    <span class="restore-wizard-phase{{if eq (printf "%s" .Wizard.Step) "intent"}} is-current{{end}}">Előkészítés</span>
-    <span class="restore-wizard-phase{{if eq (printf "%s" .Wizard.Step) "prepare-confirm"}} is-current{{end}}">Megerősítés</span>
-    <span class="restore-wizard-phase{{if eq (printf "%s" .Wizard.Step) "execution"}} is-current{{end}}">Végrehajtás</span>
-    <span class="restore-wizard-phase">Eredmény</span>
+    <span class="restore-wizard-phase{{if eq $phase "elokeszites"}} is-current{{end}}">Előkészítés</span>
+    <span class="restore-wizard-phase{{if eq $phase "megerosites"}} is-current{{end}}">Megerősítés</span>
+    <span class="restore-wizard-phase{{if eq $phase "vegrehajtas"}} is-current{{end}}">Végrehajtás</span>
+    <span class="restore-wizard-phase{{if eq $phase "eredmeny"}} is-current{{end}}">Eredmény</span>
 </div>
 
+{{with .LastResult}}
+<!-- „Eredmény": the outcome of the restore that just finished, for THIS app. The redirect flash says
+     the same thing but does not survive a reload; this does, for restoreResultWindow. -->
+<div class="settings-card">
+    <h3>Eredmény</h3>
+    <div class="alert {{if .OK}}alert-info{{else}}alert-error{{end}}">{{.Message}}</div>
+    <p class="form-hint">Befejezve: {{fmtTime .FinishedAt}}. Ha szeretnéd, alább újra indíthatsz egy visszaállítást.</p>
+</div>
+{{end}}
+
 {{if eq (printf "%s" .Wizard.Step) "execution"}}
 <!-- EXECUTION — every mutation form is suppressed server-side. The manager's single-flight would
      refuse them anyway; offering a control guaranteed to fail is the same dishonesty class R-48