Impl-2b: resolve a raw candidate's fs-UUID via /disks/candidates (enroll fix)

runStorageInit/runStorageAttach resolved the fs UUID only via agent.Disks(),
which does NOT include a raw (unenrolled, non-PVE-storage) device — so a raw
candidate could be offered but never enrolled ("no fs identifier"). New
resolveEnrollUUID falls back to the raw-device scan (/disks/candidates), which
reports each free disk's durable_id (uuid:<fs-uuid>). Both enroll paths use it;
legacy re-attach (drive in /disks) still works. Test + red-proof.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/web/storage_handlers_test.go

@@ -42,6 +42,7 @@ type mockAgent struct {
 	decommissionCalls []string
 	guestRebootCalls  int
 	guestRebootErr    error
+	candidates        agentapi.CandidatesResult
 }
 
 type assignCall struct{ uuid, where, fstype string }
@@ -54,6 +55,10 @@ func (m *mockAgent) Disks(context.Context) (agentapi.DisksResponse, error) {
 	m.disksCalls++
 	return m.disks, nil
 }
+
+func (m *mockAgent) ListCandidates(context.Context) (agentapi.CandidatesResult, error) {
+	return m.candidates, nil
+}
 func (m *mockAgent) FormatDisk(_ context.Context, device, fstype string, confirmed bool, durableID string) (agentapi.FormatResult, error) {
 	m.formatCalls = append(m.formatCalls, formatCall{device, fstype, durableID, confirmed})
 	return m.formatRes, m.formatErr
@@ -219,6 +224,31 @@ func TestRunStorageAttach_Success(t *testing.T) {
 	}
 }
 
+// Impl-2b: a RAW candidate (not in /disks — no PVE storage) attaches by resolving its fs UUID from the
+// raw-device scan's durable_id. RED-PROOF: with the old fsUUIDForDevice(Disks)-only resolution this
+// fails ("no fs identifier"), since the raw device is absent from /disks.
+func TestRunStorageAttach_RawCandidate(t *testing.T) {
+	s := testServer(t)
+	agent := &mockAgent{
+		disks: agentapi.DisksResponse{Disks: []agentapi.DiskInfo{}}, // raw device NOT in /disks
+		candidates: agentapi.CandidatesResult{
+			Attach: []agentapi.DiskCandidate{
+				{Device: "/dev/sdd", FSType: "ext4", Mountable: true, MountSource: "/dev/sdd", DurableID: "uuid:RAW-99"},
+			},
+		},
+	}
+	res, err := s.runStorageAttach(context.Background(), agent, "/dev/sdd", "ext4", "/mnt/teszt", "Teszt", false)
+	if err != nil {
+		t.Fatalf("unexpected error: %v", err)
+	}
+	if !res.Registered {
+		t.Fatal("expected registered")
+	}
+	if len(agent.assignCalls) != 1 || agent.assignCalls[0].uuid != "RAW-99" {
+		t.Fatalf("raw candidate must assign by the scan-derived fs UUID: %+v", agent.assignCalls)
+	}
+}
+
 // handleStorageRegister (the "Regisztrálás" action for an already-mounted, unregistered drive) must
 // register the STABLE intermediary path /mnt/felhom-drives/<name> — the same path runStorageInit/
 // runStorageAttach register — NOT the raw /mnt/<name> it receives. Registering the raw path made the