D1 Part 1: settings-split routes + per-page data builders

- server.go: GET /storage (Tárhely page), GET /settings/notifications
  (GET->page, POST->save dispatch on the same path), GET
  /settings/security; the enrollment wizards move to /storage/init +
  /storage/attach with 301s from the old /settings/storage/* URLs.
- handlers.go: settingsData() decomposed into settingsBaseData +
  systemPageData / storagePageData / notificationsPageData /
  securityPageData; the legacy merge remains only while the monolithic
  settings.html exists (Part 2 deletes it). All five storage action
  redirects (add/remove/default/schedulable/label) now land on
  /storage?storage_msg=... (incl. the two error-branch redirects).
- Every page keeps rendering the full legacy template in this commit —
  the site stays functional; the split lands in Part 2.
- Tests: four pages 200, wizard 301s + new URLs render, storage-label
  redirect Location prefix + flash renders on /storage, wrong-password
  inline re-render. Red-proven vs pre-split code (Location was
  /settings?..., no 301s).

controller/internal/web/server.go

@@ -262,6 +262,12 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		s.monitoringHandler(w, r)
 	case path == "/settings":
 		s.settingsHandler(w, r)
+	case path == "/storage" && r.Method == http.MethodGet:
+		s.storagePageHandler(w, r)
+	case path == "/settings/notifications" && r.Method == http.MethodGet:
+		s.settingsNotificationsPageHandler(w, r)
+	case path == "/settings/security" && r.Method == http.MethodGet:
+		s.settingsSecurityPageHandler(w, r)
 	case path == "/settings/password" && r.Method == http.MethodPost:
 		s.settingsPasswordHandler(w, r)
 	case path == "/settings/notifications" && r.Method == http.MethodPost:
@@ -280,10 +286,15 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		s.settingsStorageSchedulableHandler(w, r)
 	case path == "/settings/storage/label" && r.Method == http.MethodPost:
 		s.settingsStorageLabelHandler(w, r)
-	case path == "/settings/storage/init" && r.Method == http.MethodGet:
+	case path == "/storage/init" && r.Method == http.MethodGet:
 		s.storageWizardPageHandler(w, r, "storage_init")
-	case path == "/settings/storage/attach" && r.Method == http.MethodGet:
+	case path == "/storage/attach" && r.Method == http.MethodGet:
 		s.storageWizardPageHandler(w, r, "storage_attach")
+	// D1: the wizard pages moved under /storage — permanent redirects keep old links working.
+	case path == "/settings/storage/init" && r.Method == http.MethodGet:
+		http.Redirect(w, r, "/storage/init", http.StatusMovedPermanently)
+	case path == "/settings/storage/attach" && r.Method == http.MethodGet:
+		http.Redirect(w, r, "/storage/attach", http.StatusMovedPermanently)
 	case path == "/backup/restore" && r.Method == http.MethodPost:
 		s.backupRestoreHandler(w, r)
 	// Off-box (NAS) restic-SFTP backup (Part B)