v0.245.0 — R-543: the household is asked for the recovery code, the page says "szunetel" until then

Off-site backup is ON by default and does not RUN until the household creates its
recovery code. The pause is the zero-knowledge escrow design and is untouched here;
what was missing is that nothing ASKED, while the app-backup page promised the very
copy that had never run.

- a reminder bar on every authenticated page while the off-site tier is configured
  and its escrow is not complete, linking /backup/escrow. It is the R-241 bar, second
  instance: same session-cookie dismissal, back next visit, gone for good when
  escrowed. No second banner system. It hangs off executeTemplate, the single render
  choke point, so it cannot reach only the pages someone remembered.
- the tier-1 file sentence renders by tier3State's own vocabulary instead of the
  app's shape: active -> "vedi", escrow_pending -> "vedene ... szunetel" + the route,
  no copy at all -> says so and names both ways out.
- both fixes red-proofed: the bar test fails on BOTH pages with the hook removed; the
  sentence test quotes the exact v0.244.0 promise when the state is ignored.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/handlers.go

@@ -1182,7 +1182,12 @@ type AppBackupRow struct {
 	Tier23Contents string
 	// DriveFilesNote is non-empty exactly when this app keeps files on the data drive that a Tier-1
 	// unit cannot hold — the one sentence that tells the household where those files ARE protected.
-	DriveFilesNote string
+	// Its wording follows the tier-3 STATE, not the app's shape (R-543): a copy that is paused for
+	// the recovery code protects nothing yet, and „védi" would be the same lie R-537 was filed for.
+	// DriveFilesNoteLink is the route out of that state, empty when there is nothing to press.
+	DriveFilesNote         string
+	DriveFilesNoteLink     string
+	DriveFilesNoteLinkText string
 
 	// RestoreHeld (R-379) — this app is deliberately stopped because a database restore failed AND
 	// the rollback failed. Distinct from any backup status: it is about the app's LIVE data, not its
@@ -1379,11 +1384,6 @@ func (s *Server) buildAppBackupRows(status *backup.FullBackupStatus) []AppBackup
 		tier1Contents := withData(app.HasVolumeData && !hasDriveFileLegs)
 		// Tier 2 / Tier 3 carry the file legs, so for them „Adatok" is true either way.
 		tier23Contents := withData(app.HasVolumeData || hasDriveFileLegs)
-		driveFilesNote := ""
-		if hasDriveFileLegs {
-			driveFilesNote = "Az alkalmazás fájljait a távoli másolat (és a második meghajtó) védi — ez a helyi mentés a beállításokat és az adatbázist tartalmazza."
-		}
-
 		slug := ""
 		if s.stackMgr != nil {
 			if st, ok := s.stackMgr.GetStack(app.StackName); ok {
@@ -1403,7 +1403,6 @@ func (s *Server) buildAppBackupRows(status *backup.FullBackupStatus) []AppBackup
 			HDDSizeHuman:      app.HDDSizeHuman,
 			Tier1Contents:     tier1Contents,
 			Tier23Contents:    tier23Contents,
-			DriveFilesNote:    driveFilesNote,
 			Tier1DBStatus:     tier1DBStatus,
 		}
 
@@ -1515,6 +1514,12 @@ func (s *Server) buildAppBackupRows(status *backup.FullBackupStatus) []AppBackup
 			}
 		}
 
+		// The one sentence about the app's own FILES. Set HERE, at the end of the loop, because it
+		// depends on the tier states resolved above — a note computed from the app's shape alone
+		// promised a copy that was paused (R-543). See driveFilesNoteFor.
+		row.DriveFilesNote, row.DriveFilesNoteLink, row.DriveFilesNoteLinkText =
+			driveFilesNoteFor(hasDriveFileLegs, row.Tier3State, row.Tier2Configured)
+
 		rows = append(rows, row)
 	}
 	// R-487: the list is keyed on the DRIVES, not on what is deployed — a removed app whose unit was