R-553: four decisions stop reading their own Hungarian words (sites 1-4)

Every Hungarian sentence is byte-identical; each decision now reads a signal set where the message is
made. util.KindErrorf builds the same bytes fmt.Errorf did while carrying a sentinel for errors.Is.

- Deploy status (api/router.go): deployStatusFor() by kind — stacks.ErrAlreadyDeployed (409),
  ErrRequiredField / ErrPathMissing / ErrNotEnoughMemory (400). The „kötelező" / „memória" /
  "does not exist" / "already deployed" text chain is gone.
- Off-site failure class (backup/offbox.go): ErrOffsiteQuota replaces the „tárhelykeretet" match. The
  restic/ssh signatures stay text matches on purpose — that output is not ours and is not translated.
- Alert placement (web/alerts.go): monitor.HealthReport carries WarningKinds parallel to Warnings;
  the "not on a separate drive" warning is inline by KIND. The hub report is untouched (builder.go
  copies Status/Issues/Warnings only) — pinned by a wire test.
- Stale off-site note (web/handlers.go): settings LastWarningKind + backup.OffboxWarnNoAppsSelected.
  The text test survives ONLY for kind == "" (a box whose last run predates 0.251.0) and is removed
  when R-570 closes; slice 2 must not translate that producer before then.

Tests (all red-proofed by restoring the pre-fix predicate — see the audit's redproofs.txt):
TestR553_Deploy_DecisionSurvivesWordingChange, TestR553_DeployHandlerUsesTheKind,
TestR553_DeployProducersCarryKindAndKeepTheirWords (through the real DeployStack),
TestR553_OffsiteQuota_{Decision,HeadLine}SurvivesWordingChange, TestR553_OffboxRunRecordsTheKind,
TestR553_StorageWarningsCarryKindsAndKeepTheirWords, TestR553_DiskWarningPlacementSurvivesWordingChange,
TestR553_HubReportWarningsAreUnchangedOnTheWire, TestR553_StaleNote*, TestR553_WarningKindIsPersistedAndCopied.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/util/errkind.go

@@ -0,0 +1,36 @@
+package util
+
+import "fmt"
+
+// R-553 — a decision must never be made by reading a customer-facing Hungarian word.
+//
+// Five places in this product branched on their own copy (`strings.Contains(err.Error(), "kötelező")`
+// and friends). The day that copy is translated — localisation slice 2 — every one of them silently
+// takes the other branch: an install error becomes a 500, a quota failure reads as "unknown cause".
+//
+// KindErrorf is the fix in one line: it produces the EXACT same message bytes as `fmt.Errorf` while
+// carrying a sentinel that `errors.Is` can test. The message is display; the sentinel is the decision.
+//
+//	return util.KindErrorf(ErrRequiredField, "a(z) %q mező kitöltése kötelező", label)
+//	...
+//	if errors.Is(err, stacks.ErrRequiredField) { status = http.StatusBadRequest }
+//
+// Deliberately NOT `fmt.Errorf("%w: …")`: that prepends the sentinel's own text and would change the
+// sentence the customer reads, which a localisation-adjacent change may never do.
+func KindErrorf(kind error, format string, a ...interface{}) error {
+	return &kindError{kind: kind, msg: fmt.Sprintf(format, a...)}
+}
+
+// KindError wraps an existing message (a string built elsewhere) with its kind, bytes unchanged.
+func KindError(kind error, msg string) error { return &kindError{kind: kind, msg: msg} }
+
+type kindError struct {
+	kind error
+	msg  string
+}
+
+func (e *kindError) Error() string { return e.msg }
+
+// Unwrap is what makes errors.Is(err, kind) true. It deliberately returns the KIND, not a cause
+// chain: the message is a leaf, and the kind is the only thing a caller may branch on.
+func (e *kindError) Unwrap() error { return e.kind }