D1 Part 3: unified drive view + overlay migration

- storage.html: the registry cards and the separate 'Meghajtók (ügynök
  nézet)' merge into ONE view. Each connected registry card gets an
  #agent-extra-<path> slot; the enrichment JS joins the agent /api/disks
  list on mount path and decorates the matching card in place (role tag
  via i-lock, drive class, durable-id mono line, agent-only
  register/eject/wipe actions). Two extra groups render below:
  'Rendszermeghajtók' (system/backup — read-only, lock tag, NO actions)
  and 'Nem regisztrált meghajtók' (unregistered user-data — register
  action only). Agent-down: one warn note into #agent-warn-note, all
  registry cards still render from server data (graceful degradation).
  The agent-view helpers now emit design-system .tag markup instead of
  .badge (roleTag/classTag/dataTag/regTag/appBackingTag); the 🔒 lock
  emoji is gone (sprite i-lock).
- Overlay migration: every native confirm()/prompt() on the four pages
  routes through a light .confirm-overlay dialog (openDialog; texts
  verbatim) — storage remove forms, netStorageRemove, storageMigrateAll,
  storageDisconnect, storageDecommission (migrate + the type-to-confirm
  anyway branch preserved like-for-like), storageReEnroll; and on the
  system page triggerUpdate + controller/server restart; on the security
  page the two geo Hungary-removal confirms. Scenario F grep: zero
  native confirm/prompt in the four templates.
- Deleted the now-orphaned .badge-lock/.lock-ico CSS (grep-zero first).
- Tests: no-native-confirm scan, agent-down warn-note static assertion;
  integrity gate stays green.

controller/internal/web/settings_split_test.go

@@ -7,6 +7,7 @@ import (
 	"net/http/httptest"
 	"net/url"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"testing"
 
@@ -212,3 +213,42 @@ func TestPasswordErrorRerendersSecurityPage(t *testing.T) {
 		t.Error("re-rendered page lacks the password form section")
 	}
 }
+
+// TestStorageNoNativeConfirm (D1 Scenario F): the four split templates contain no native
+// confirm()/prompt() — all consequential actions route through the overlay.
+func TestStorageNoNativeConfirm(t *testing.T) {
+	nativeRe := regexp.MustCompile(`(^|[^A-Za-z_.])(confirm|prompt)\(`)
+	// allow the pre-existing type-to-confirm overlay helper names
+	allow := regexp.MustCompile(`openConfirm|__closeConfirm|confirmEject|confirmWipe|typeToConfirm|confirm-`)
+	for _, f := range []string{"storage.html", "settings_system.html", "settings_notifications.html", "settings_security.html"} {
+		b, err := templateFS.ReadFile("templates/" + f)
+		if err != nil {
+			t.Fatalf("read %s: %v", f, err)
+		}
+		for i, line := range strings.Split(string(b), "\n") {
+			if nativeRe.MatchString(line) && !allow.MatchString(line) {
+				t.Errorf("%s:%d native confirm/prompt: %s", f, i+1, strings.TrimSpace(line))
+			}
+		}
+	}
+}
+
+// TestStorageAgentDownNote (D1 Scenario C, static): the enrichment JS has an error path that
+// renders the exact warn note into #agent-warn-note (graceful degradation when the agent is down).
+func TestStorageAgentDownNote(t *testing.T) {
+	b, err := templateFS.ReadFile("templates/storage.html")
+	if err != nil {
+		t.Fatal(err)
+	}
+	body := string(b)
+	if !strings.Contains(body, `id="agent-warn-note"`) {
+		t.Error("missing #agent-warn-note element")
+	}
+	if !strings.Contains(body, "Az ügynök nem elérhető") {
+		t.Error("missing the agent-unreachable warn text")
+	}
+	// the catch block must target the note element
+	if !strings.Contains(body, "warn.innerHTML=") {
+		t.Error("enrichment JS lacks the warn-note error path")
+	}
+}