v0.147.0 — feedback slice 1: pressing a button says something

The systemic complaint, twice in one evening: you press a button and nothing
happens. No progress, no ETA, no named result. Three worst offenders, fixed on
the two patterns already here (deploy 3-step panel, storage-init status poll).
No new framework — that is a ROADMAP item; three targeted cards ship tonight.

4a — a verification restore names its result. The flash said the app had been
restored "to a verification folder on the drive"; which folder, on which drive,
was invisible, so the customer could not go and look at what they had just asked
for. Full path now. The restore page gained a listing of existing verification
copies (app, size, date, path) — nothing anywhere showed these, so they piled up
and the only way to find them was SSH — each with a double-confirmed delete.

That delete is the only one this release adds, so it names a STACK, never a
path: the Manager resolves the name inside a backups/offsite-restore root it
computed itself and refuses anything landing outside. Red-proofed — neutralise
the name guard and stack:"" resolves to the offsite-restore ROOT and takes every
copy with it. Refusals are asserted as non-effects.

4b — Megosztás enable shows what it is waiting for. Enabling ran ReconcileSamba
synchronously inside the POST handler; on a golden without felhom-samba baked
that is compose pulling ~100MB, i.e. minutes of an apparently-hung form post
followed by "Beállítás mentve." whether or not anything came up. Detached +
polled now, distinguishing "képfájl letöltése" from "indítás" — decided BEFORE
the work starts, since afterwards the image is always present. Success is
probed, not inferred (compose up -d exits 0 on a crash-loop). The password form
starts the same job: with UserSet false reconcile deploys nothing, so on a fresh
box that is where the pull actually happens.

4c — "Távoli mentés most" streams real progress. restic was already reporting
bytes and percent; the runner seam used CombinedOutput() and discarded them. The
manual run now passes --json and scans stdout line-by-line: total bytes, percent,
current app. Manual only — the nightly stays silent, pinned by a test that fails
if it ever passes --json. The poll now arms unconditionally, closing a race the
manual trigger always ran: the redirect rendered before the goroutine wrote
LastStatus=running, so the poll never armed and the page sat static during the
very run just started. Red-proofed twice.

Also closes the golden/controller infra-image drift at the source: infra.Images()
derives from the existing pins and --print-infra-images exposes it, so the golden
bake can stop carrying its own copy. That copy had already drifted — felhom-samba
was never added, so the golden baked 3 of 4, which is why enabling Megosztás
pulled at runtime in the first place.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE

controller/internal/backup/offbox.go

@@ -572,6 +572,22 @@ func (m *Manager) ensureOffboxRepo(ctx context.Context, base, env []string) erro
 // tars) to the SFTP repo, then prunes per the retention policy. Single-flight + migration-guarded. A
 // failure (incl. a fail-fast dead-NAS error) records status + alerts the operator. Returns the first error.
 func (m *Manager) RunOffboxBackup(ctx context.Context) error {
+	return m.runOffboxBackup(ctx, false)
+}
+
+// RunOffboxBackupWithProgress is the MANUAL („Távoli mentés most") entry point: identical work, but
+// with the live progress sink installed so the page can show total bytes, percent and current app
+// (v0.147.0, 4c). The nightly scheduled run keeps calling RunOffboxBackup and stays silent — nobody
+// is watching a progress bar at 03:00, and a sink left installed would publish stale percentages
+// into a page that never asked for them.
+func (m *Manager) RunOffboxBackupWithProgress(ctx context.Context) error {
+	return m.runOffboxBackup(ctx, true)
+}
+
+func (m *Manager) runOffboxBackup(ctx context.Context, withProgress bool) error {
+	if withProgress {
+		defer m.beginManualProgress()()
+	}
 	if !m.OffboxConfigured() {
 		return fmt.Errorf("off-box backup not configured")
 	}
@@ -890,7 +906,9 @@ func (m *Manager) runOffboxInternal(ctx context.Context, apps, base, env []strin
 		}
 		args := append([]string{"backup", "--tag", "felhom-offbox", "--tag", stack, src}, extra...)
 		bctx, cancel := context.WithTimeout(ctx, offboxBackupTimeout)
-		out, berr := m.resticStep(bctx, env, base, "backup:"+stack, args...)
+		// Streaming twin (4c): identical to resticStep unless a MANUAL run installed a progress sink,
+		// in which case it adds --json and feeds the parsed status lines to the page's poll.
+		out, berr := m.resticBackupStep(bctx, env, base, "backup:"+stack, stack, args...)
 		cancel()
 		if berr != nil {
 			m.logger.Printf("[ERROR] [offbox] backup %s failed: %v: %s", stack, berr, truncate(out))