v0.147.0 — feedback slice 1: pressing a button says something

The systemic complaint, twice in one evening: you press a button and nothing
happens. No progress, no ETA, no named result. Three worst offenders, fixed on
the two patterns already here (deploy 3-step panel, storage-init status poll).
No new framework — that is a ROADMAP item; three targeted cards ship tonight.

4a — a verification restore names its result. The flash said the app had been
restored "to a verification folder on the drive"; which folder, on which drive,
was invisible, so the customer could not go and look at what they had just asked
for. Full path now. The restore page gained a listing of existing verification
copies (app, size, date, path) — nothing anywhere showed these, so they piled up
and the only way to find them was SSH — each with a double-confirmed delete.

That delete is the only one this release adds, so it names a STACK, never a
path: the Manager resolves the name inside a backups/offsite-restore root it
computed itself and refuses anything landing outside. Red-proofed — neutralise
the name guard and stack:"" resolves to the offsite-restore ROOT and takes every
copy with it. Refusals are asserted as non-effects.

4b — Megosztás enable shows what it is waiting for. Enabling ran ReconcileSamba
synchronously inside the POST handler; on a golden without felhom-samba baked
that is compose pulling ~100MB, i.e. minutes of an apparently-hung form post
followed by "Beállítás mentve." whether or not anything came up. Detached +
polled now, distinguishing "képfájl letöltése" from "indítás" — decided BEFORE
the work starts, since afterwards the image is always present. Success is
probed, not inferred (compose up -d exits 0 on a crash-loop). The password form
starts the same job: with UserSet false reconcile deploys nothing, so on a fresh
box that is where the pull actually happens.

4c — "Távoli mentés most" streams real progress. restic was already reporting
bytes and percent; the runner seam used CombinedOutput() and discarded them. The
manual run now passes --json and scans stdout line-by-line: total bytes, percent,
current app. Manual only — the nightly stays silent, pinned by a test that fails
if it ever passes --json. The poll now arms unconditionally, closing a race the
manual trigger always ran: the redirect rendered before the goroutine wrote
LastStatus=running, so the poll never armed and the page sat static during the
very run just started. Red-proofed twice.

Also closes the golden/controller infra-image drift at the source: infra.Images()
derives from the existing pins and --print-infra-images exposes it, so the golden
bake can stop carrying its own copy. That copy had already drifted — felhom-samba
was never added, so the golden baked 3 of 4, which is why enabling Megosztás
pulled at runtime in the first place.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Nn3VgQk9iwEGgyx6QJ2NvE

controller/internal/web/templates/sharing.html

@@ -38,6 +38,13 @@
         </div>
     </form>
 
+    <!-- v0.147.0 (4b): bring-up progress. Hidden until the poll reports a non-idle phase, so a page
+         with nothing in flight looks exactly as it did before. This is what makes the first-enable
+         wait survivable on a golden that has not baked felhom-samba: the pull is named, not silent. -->
+    <div id="samba-progress" class="alert alert-info" style="display:none">
+        <span id="samba-progress-text"></span>
+    </div>
+
     <div class="form-group">
         <span>Állapot:</span>
         {{if .SMBRunning}}
@@ -282,6 +289,54 @@ function shareBrowseLoad(p){
             });
         });
 }
+
+/* v0.147.0 (4b) — Megosztás bring-up poll. Same shape as the storage-init status poll
+   (storage_init.html): 1.5s tick, phase string mapped to Hungarian, terminal states stop the timer.
+   The card only ever appears while something is genuinely in flight. */
+(function(){
+    var box = document.getElementById('samba-progress');
+    var txt = document.getElementById('samba-progress-text');
+    if (!box || !txt) return;
+    var PHASES = {
+        pulling:        'A megosztási szolgáltatás előkészítése… (képfájl letöltése — ez több percig tarthat)',
+        starting:       'A megosztási szolgáltatás indítása…',
+        needs_password: 'A megosztás be van kapcsolva, de még nincs megosztási jelszó — add meg alább.'
+    };
+    var timer = null;
+    function stop(){ if (timer) { clearInterval(timer); timer = null; } }
+    function show(cls, text){
+        box.className = 'alert ' + cls;
+        txt.textContent = text;
+        box.style.display = '';
+    }
+    function tick(){
+        fetch('/sharing/status', {credentials:'same-origin'})
+            .then(function(r){ return r.json(); })
+            .then(function(j){
+                if (!j || !j.ok || !j.data) return;   // transient — keep polling
+                var ph = j.data.phase;
+                if (PHASES[ph]) { show('alert-info', PHASES[ph]); return; }
+                if (ph === 'running') {
+                    stop();
+                    show('alert-success', 'A megosztási szolgáltatás fut.');
+                    /* Repaint the „Állapot" badge, which was rendered server-side as „áll". */
+                    setTimeout(function(){ location.reload(); }, 1200);
+                    return;
+                }
+                if (ph === 'failed') {
+                    stop();
+                    show('alert-error', 'A megosztási szolgáltatás nem indult el' + (j.data.error ? ': ' + j.data.error : '.'));
+                    return;
+                }
+                /* idle and nothing running: nothing to report. */
+                stop();
+                box.style.display = 'none';
+            })
+            .catch(function(){ /* transient — keep polling */ });
+    }
+    tick();
+    timer = setInterval(tick, 1500);
+})();
 </script>
 
 {{template "layout_end" .}}