v0.76.0: campaign-#3 hardening (settings .bak recovery, restore stack_name validation, quiesce marker quarantine)

S1: corrupt settings.json recovers from .bak / safe-defaults+preserve, no crash-loop.
F2: validStackName gates restore + export handlers (reject /,\,..,NUL traversal).
S3: corrupt quiesce marker logged + quarantined, not silently dropped.
Tests T-S1/F2/S3 + red-proofs. Agent/hub untouched.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/web/templates/dashboard.html

@@ -87,6 +87,14 @@
         {{end}}
         {{end}}
     </div>
+    {{if .SettingsWarning}}
+    <div class="inline-warnings">
+        <div class="inline-warning inline-warning-error">
+            <span class="inline-warning-dot">●</span>
+            <span class="inline-warning-text">{{.SettingsWarning}}</span>
+        </div>
+    </div>
+    {{end}}
     {{if .DiskWarnings}}
     <div class="inline-warnings">
         {{range .DiskWarnings}}