v0.150.0 — green gate restored + the export link stops leaking the CSRF token

F7/R-53: app_export.html built the app's public URL as '<sub>.{{$.CSRFToken}}',
so the "Megnyitás" link was wrong for every app with a subdomain and a session
CSRF token was written into a URL. Template now uses {{$.Domain}}, and
exportPageHandler supplies the key — it builds its own data map instead of
going through baseData, which is where every other page gets it. The page's
real CSRF path (csrfH() reading the meta tag) is correct and untouched.

The 7 red internal/backup tests are green again, with no behaviour change.
TestTier2V2_* / TestSharesTier2* all failed for one environmental reason:
Tier-2's off-drive guard asks system.SamePhysicalDevice (st_dev equality)
whether a target is really a second disk, and every t.TempDir() here shares one
filesystem — so the guard correctly refused the fixture's "two drives" and the
tests never reached their subject ("nincs másik fizikai meghajtó").

Seam in the package's existing style: a nil-defaulted Manager.samePhysicalDevice
field + sameDevice wrapper, seven call sites routed through it. Nil resolves to
system.SamePhysicalDevice, so production is byte-for-byte unchanged; only the two
fixtures inject a fake modelling one drive per directory subtree. No assertion
weakened, nothing skipped/renamed/deleted; all 7 mutation-proved.

Also: the ssh->pct-exec ASCII-grep and heredoc-credential traps are now in
CLAUDE.md's live-validation section.

CLAUDE.md

@@ -110,6 +110,15 @@ state). **`claude-in-chrome` is NOT available in the DooPlex environment** — t
 endpoint-level: invoke the exact endpoint the UI invokes (no server logic is skipped, only
 rendering) and say which method was used. Strict end-to-end UI coverage is a manual click-through.
 
+Two traps in that method, both from the 2026-07-20 remediation:
+- **Grep the fetched page with ASCII-only substrings.** Accented Hungarian patterns get mangled
+  through the `ssh → pct exec → bash -c` chain and return a false `0` — which reads exactly like the
+  banner/string being gone. Use `kezel`, `Utols`, `Biztons`; never let an accented pattern gate a
+  conclusion (it nearly produced a wrong "banner cleared" claim).
+- **Credentials with `!` or `'` break in heredoc-built helper scripts** (history expansion eats
+  `!!`). Use the proven inline `-d "password=$PW"` form for authed curl, and delete any
+  credential-bearing helper from `/tmp` (host AND guest) when done.
+
 ## Environment & access
 
 Claude Code runs **on DooPlex (192.168.0.180, Debian 13, user `kisfenyo`)**; repos in