feat(backup): async restore family — no proxy-timeout error page on a succeeding restore (v0.102.0)

Re-adjudicates F4: /backup/restore, /backup/tier2/restore, /backup/offbox/restore
blocked the HTTP request until completion, so through cloudflared's 100s cap a
customer got an error page while the restore succeeded (offbox worse — bounded
on r.Context(), canceling the SFTP restore mid-flight). Convert all three to the
offboxRun async shape: fast-path IsRunning refuse, background goroutine
(offbox ctx off r.Context() -> Background+30m), instant redirect. Add mutex-
guarded op-status (opstatus.go) + GET /api/backup/restore-status + a 3s-polling
backups.html banner (neutral running, red on failure). Restore single-flight
unchanged. Tests + red-proof (sync handler blocks indefinitely vs <500ms async).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/backup/backup.go

@@ -63,6 +63,13 @@ type Manager struct {
 	lastDBDump *DBDumpStatus
 	running    bool
 
+	// Restore op-status (Part B, opstatus.go) — display-only async-restore progress, under `mu`.
+	opRunning   bool
+	opName      string
+	opStack     string
+	opStartedAt time.Time
+	opLast      *RestoreOpResult
+
 	// Cached status for page rendering (refreshed periodically)
 	cachedStatus *FullBackupStatus
 	cacheTime    time.Time