R-553: four decisions stop reading their own Hungarian words (sites 1-4)

Every Hungarian sentence is byte-identical; each decision now reads a signal set where the message is
made. util.KindErrorf builds the same bytes fmt.Errorf did while carrying a sentinel for errors.Is.

- Deploy status (api/router.go): deployStatusFor() by kind — stacks.ErrAlreadyDeployed (409),
  ErrRequiredField / ErrPathMissing / ErrNotEnoughMemory (400). The „kötelező" / „memória" /
  "does not exist" / "already deployed" text chain is gone.
- Off-site failure class (backup/offbox.go): ErrOffsiteQuota replaces the „tárhelykeretet" match. The
  restic/ssh signatures stay text matches on purpose — that output is not ours and is not translated.
- Alert placement (web/alerts.go): monitor.HealthReport carries WarningKinds parallel to Warnings;
  the "not on a separate drive" warning is inline by KIND. The hub report is untouched (builder.go
  copies Status/Issues/Warnings only) — pinned by a wire test.
- Stale off-site note (web/handlers.go): settings LastWarningKind + backup.OffboxWarnNoAppsSelected.
  The text test survives ONLY for kind == "" (a box whose last run predates 0.251.0) and is removed
  when R-570 closes; slice 2 must not translate that producer before then.

Tests (all red-proofed by restoring the pre-fix predicate — see the audit's redproofs.txt):
TestR553_Deploy_DecisionSurvivesWordingChange, TestR553_DeployHandlerUsesTheKind,
TestR553_DeployProducersCarryKindAndKeepTheirWords (through the real DeployStack),
TestR553_OffsiteQuota_{Decision,HeadLine}SurvivesWordingChange, TestR553_OffboxRunRecordsTheKind,
TestR553_StorageWarningsCarryKindsAndKeepTheirWords, TestR553_DiskWarningPlacementSurvivesWordingChange,
TestR553_HubReportWarningsAreUnchangedOnTheWire, TestR553_StaleNote*, TestR553_WarningKindIsPersistedAndCopied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/deploy.go

@@ -4,7 +4,6 @@ import (
 	"crypto/rand"
 	"encoding/base64"
 	"encoding/hex"
-	"errors"
 	"fmt"
 	"log"
 	"math/big"
@@ -17,6 +16,7 @@ import (
 	"gitea.dooplex.hu/admin/felhom-controller/internal/appbackup"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/crypto"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/system"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/util"
 	"gopkg.in/yaml.v3"
 )
 
@@ -202,7 +202,7 @@ func (m *Manager) DeployStack(req DeployRequest) (string, error) {
 	}
 	if sPtr.Deployed {
 		m.mu.Unlock()
-		return "", fmt.Errorf("stack %q is already deployed; use update instead", req.StackName)
+		return "", util.KindErrorf(ErrAlreadyDeployed, "stack %q is already deployed; use update instead", req.StackName)
 	}
 	sPtr.Deploying = true
 	sPtr.DeployError = ""
@@ -242,7 +242,7 @@ func (m *Manager) DeployStack(req DeployRequest) (string, error) {
 	refusal, deployWarning := m.memoryVerdict(ParseMemoryMB(meta.Resources.MemRequest), ParseMemoryMB(meta.Resources.MemLimit), 0, 0)
 	if refusal != "" {
 		clearDeploying()
-		return "", errors.New(refusal)
+		return "", util.KindError(ErrNotEnoughMemory, refusal)
 	}
 
 	// Debug: log received values (redact passwords/secrets)
@@ -308,7 +308,7 @@ func (m *Manager) DeployStack(req DeployRequest) (string, error) {
 				value = userVal
 			} else {
 				clearDeploying()
-				return "", fmt.Errorf("a(z) %q mező kitöltése kötelező — használja a Generálás gombot vagy írjon be egy jelszót", field.Label)
+				return "", util.KindErrorf(ErrRequiredField, "a(z) %q mező kitöltése kötelező — használja a Generálás gombot vagy írjon be egy jelszót", field.Label)
 			}
 
 		default:
@@ -323,14 +323,14 @@ func (m *Manager) DeployStack(req DeployRequest) (string, error) {
 		// Validate required fields
 		if field.Required && value == "" {
 			clearDeploying()
-			return "", fmt.Errorf("a(z) %q (%s) mező kitöltése kötelező", field.Label, field.EnvVar)
+			return "", util.KindErrorf(ErrRequiredField, "a(z) %q (%s) mező kitöltése kötelező", field.Label, field.EnvVar)
 		}
 
 		// Validate path fields exist on the host filesystem
 		if field.Type == "path" && value != "" {
 			if _, err := os.Stat(value); os.IsNotExist(err) {
 				clearDeploying()
-				return "", fmt.Errorf("path %q does not exist for field %q", value, field.Label)
+				return "", util.KindErrorf(ErrPathMissing, "path %q does not exist for field %q", value, field.Label)
 			}
 		}
 
@@ -408,7 +408,9 @@ func (m *Manager) DeployStack(req DeployRequest) (string, error) {
 //
 // Same shape as SetMigrationDoneHook, deliberately: the policy (which event, what wording) lives in
 // the caller, and this package only reports what happened.
-func (m *Manager) SetDeployDoneHook(fn func(name string, ok bool, detail string)) { m.deployDoneHook = fn }
+func (m *Manager) SetDeployDoneHook(fn func(name string, ok bool, detail string)) {
+	m.deployDoneHook = fn
+}
 
 func (m *Manager) runComposeDeploy(name, stackDir string, env map[string]string, appCfg *AppConfig) {
 	start := time.Now()