v0.150.0 — green gate restored + the export link stops leaking the CSRF token

F7/R-53: app_export.html built the app's public URL as '<sub>.{{$.CSRFToken}}',
so the "Megnyitás" link was wrong for every app with a subdomain and a session
CSRF token was written into a URL. Template now uses {{$.Domain}}, and
exportPageHandler supplies the key — it builds its own data map instead of
going through baseData, which is where every other page gets it. The page's
real CSRF path (csrfH() reading the meta tag) is correct and untouched.

The 7 red internal/backup tests are green again, with no behaviour change.
TestTier2V2_* / TestSharesTier2* all failed for one environmental reason:
Tier-2's off-drive guard asks system.SamePhysicalDevice (st_dev equality)
whether a target is really a second disk, and every t.TempDir() here shares one
filesystem — so the guard correctly refused the fixture's "two drives" and the
tests never reached their subject ("nincs másik fizikai meghajtó").

Seam in the package's existing style: a nil-defaulted Manager.samePhysicalDevice
field + sameDevice wrapper, seven call sites routed through it. Nil resolves to
system.SamePhysicalDevice, so production is byte-for-byte unchanged; only the two
fixtures inject a fake modelling one drive per directory subtree. No assertion
weakened, nothing skipped/renamed/deleted; all 7 mutation-proved.

Also: the ssh->pct-exec ASCII-grep and heredoc-credential traps are now in
CLAUDE.md's live-validation section.

CHANGELOG.md

@@ -1,5 +1,32 @@
 ## Changelog
 
+### v0.150.0 — green gate restored + the export link stops leaking the CSRF token (2026-07-20)
+
+**F7 / R-53 — `app_export.html` built the app's public URL from the CSRF token.** The line read
+`var domain = '<subdomain>.{{$.CSRFToken}}'`, so the „Megnyitás" link was wrong for every app with a
+subdomain and a session CSRF token was written into a URL (history, referrers, logs). Two-part fix:
+the template token becomes `{{$.Domain}}`, and `exportPageHandler` supplies `Domain` — that handler
+builds its own data map instead of going through `baseData`, which is where every other page gets
+the key, so the template had nothing to read. The page's real CSRF path (the `csrfH()` helper
+reading the meta tag) is correct and untouched. Render tests assert the joined `<sub>.<domain>` and
+that the token appears nowhere on that line; red-proofed against the pre-fix template.
+
+**The 7 red `internal/backup` tests are green again — no behaviour change.** `TestTier2V2_*` and
+`TestSharesTier2*` had been failing on DooPlex since before v0.149.0. Root cause is environmental,
+one class for all seven: Tier-2's off-drive guard asks `system.SamePhysicalDevice` (st_dev equality)
+whether a candidate target is really a *second* disk, and on a host where every `t.TempDir()` lands
+on one filesystem the fixture's "two drives" are indistinguishable — so the guard correctly refused
+the target and the tests could never reach their subject. The failure message said so outright:
+`nincs másik fizikai meghajtó`.
+
+Fixed with one behaviour-preserving seam in the package's existing style: a nil-defaulted
+`Manager.samePhysicalDevice` field plus a `sameDevice` wrapper, with the seven call sites routed
+through it. **Nil → `system.SamePhysicalDevice`, so production is byte-for-byte unchanged**; only
+the two test fixtures install a fake that models one drive per directory subtree. No assertion was
+weakened, no test skipped, renamed or deleted, and every one of the seven was mutation-proved: the
+defect each guards was re-introduced one at a time and each test failed, including the notifier
+test's own documented red-proof (`_shares` reaching Hungarian copy).
+
 ### v0.149.0 — the dashboard tells the truth about the last backup (2026-07-20)
 
 Closes **F3** from `felhom.eu/documentation/audits/AUDIT-vacation-remote-ops-2026-07-20.md`.