R-304 option C: operator mail when a household's code opens or may open an older package (once a day); R-298 side fix (no eject/format on a backup-target drive); R-717 comments

Unreleased; ships with tomorrow's release (needs the hub of the same day).

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/templates/storage.html

@@ -302,6 +302,11 @@ window.__registeredPaths=[{{range .StoragePaths}}{{if .Path}}"{{.Path}}",{{end}}
   function actions(d, registered, hasSafeDisconnect){
     // Destructive controls ONLY for user-data drives that are mounted under /mnt. System/backup get none.
     if(d.role!=='user-data' || !d.mount_path || d.mount_path.indexOf('/mnt/')!==0) return '';
+    // A user-data drive that ALSO backs the whole-system backup (agent `backup_target`): the agent refuses its eject
+    // (403) and a data-bearing format needs a signed job, so neither button is offered (R-298 design, 2026-10-08).
+    if(d.backup_target){
+      return registered[regKey(d)] ? '' : '<div class="drive-actions"><button class="btn btn-xs btn-primary" onclick="registerDrive(\''+esc(d.mount_path)+'\')">{{T "storage.regisztralas"}}</button></div>';
+    }
     var dev = esc(d.backing_device||''), mpRaw = esc(d.mount_path), reg = esc(regKey(d));
     var btns = '';
     // Two distinct path arguments (the intermediary model):