v0.150.0 — green gate restored + the export link stops leaking the CSRF token

F7/R-53: app_export.html built the app's public URL as '<sub>.{{$.CSRFToken}}',
so the "Megnyitás" link was wrong for every app with a subdomain and a session
CSRF token was written into a URL. Template now uses {{$.Domain}}, and
exportPageHandler supplies the key — it builds its own data map instead of
going through baseData, which is where every other page gets it. The page's
real CSRF path (csrfH() reading the meta tag) is correct and untouched.

The 7 red internal/backup tests are green again, with no behaviour change.
TestTier2V2_* / TestSharesTier2* all failed for one environmental reason:
Tier-2's off-drive guard asks system.SamePhysicalDevice (st_dev equality)
whether a target is really a second disk, and every t.TempDir() here shares one
filesystem — so the guard correctly refused the fixture's "two drives" and the
tests never reached their subject ("nincs másik fizikai meghajtó").

Seam in the package's existing style: a nil-defaulted Manager.samePhysicalDevice
field + sameDevice wrapper, seven call sites routed through it. Nil resolves to
system.SamePhysicalDevice, so production is byte-for-byte unchanged; only the two
fixtures inject a fake modelling one drive per directory subtree. No assertion
weakened, nothing skipped/renamed/deleted; all 7 mutation-proved.

Also: the ssh->pct-exec ASCII-grep and heredoc-credential traps are now in
CLAUDE.md's live-validation section.

controller/internal/backup/device_seam_test.go

@@ -0,0 +1,28 @@
+package backup
+
+import (
+	"path/filepath"
+	"strings"
+)
+
+// oneDrivePerSubtree is the test stand-in for system.SamePhysicalDevice (st_dev equality).
+//
+// Why it exists: the real predicate asks "are these two paths on the same physical disk?", and
+// Tier-2's whole purpose is to refuse a target that is. On a host where every t.TempDir() lands on
+// one filesystem — DooPlex, and any CI box with a single volume — a fixture's "usb" and "flash"
+// dirs share one st_dev, so the guard correctly refuses them and the off-drive tests can never
+// exercise their subject. This models what the fixture is actually depicting: one drive per
+// directory subtree, so two paths share a device only when one contains the other (a path inside a
+// drive IS on that drive). Unrelated subtrees are distinct devices, exactly as real mountpoints are.
+//
+// It does NOT relax any assertion — the guard still runs, still refuses same-device targets (see
+// TestSharesTier2NeverTargetsItsOwnSourceDrive, which passes under this seam), and production keeps
+// using the real st_dev check because the seam is nil there.
+func oneDrivePerSubtree(a, b string) bool {
+	a, b = filepath.Clean(a), filepath.Clean(b)
+	if a == b {
+		return true
+	}
+	sep := string(filepath.Separator)
+	return strings.HasPrefix(a, b+sep) || strings.HasPrefix(b, a+sep)
+}