R-241 part 4: the three-state surface, and the copy tells the truth about the date

FULL PAGE ONCE PER ENTRY, NOT ONCE EVER. "Most nem" used to set a flag that
nothing ever cleared, so a box that abandoned its history and was rebuilt
months later - a genuinely NEW situation - would never see the page again. The
offer now carries an EPOCH, advanced on the edge into the offered state, and a
dismissal is recorded against the epoch it was made in. A fresh entry passes
the dismissal by arithmetic, with nothing to clear and nothing that can be
forgotten to clear.

That is NOT the flag the operator's ruling forbids. The forbidden thing
remembers that the customer decided so the screen can be suppressed while the
state stays wrong. This records WHICH SITUATION a dismissal was about.

A REAL BUG, caught by the test and not by review: the first draft returned
early from recoveryInterrupts when the offer was false, so the FALLING edge
was never recorded, RecoveryOfferActive stayed true through a settled period,
and the next entry counted as a continuation. The page never came back - the
exact defect the epoch exists to fix, reintroduced inside the fix. The sync is
now unconditional and the ordering is commented as load-bearing.

THREE LEVERS, THREE SCOPES, and none of them removes the route:
  - clicking the bar away  -> a browser SESSION cookie, cleared on login, so
    the reminder is genuinely back at the next login. Nothing persisted.
  - "ne emlekeztessen ujra" -> durable, epoch-scoped, silences the BANNER ONLY.
    It starts no countdown, abandons nothing, and a fresh entry reminds again.
  - "most nem" -> suppresses the full page only, as before.
The entry point on /backups/remote is bound to the OFFER and to nothing else,
pinned by a test that fires all three dismissals and asserts it survives.

SEC 7.3 / Q7 - THE TRAP DOES NOT SURVIVE THIS SESSION. While a recovery is
outstanding the "Helyrealitasi kod letrehozasa" button is UNAVAILABLE, not
merely captioned: creating a new code seals the current key, demotes the
package that opens the earlier history to retained custody that no shipped
path can read (R-199), and re-enables the recovery screen through the orphan
route while invalidating the code that screen accepts. A warning beside a
button is a warning people click past. The card now explains and points at
/recovery instead.

SEC 2.4 - the abandon confirmation changes with the behaviour. It used to
promise "felretesszuk - nem toroljuk". It now states the grace in days (from
the constant the countdown actually uses, never a literal in prose), that the
sealed package goes with it, that the customer can change their mind, where
the date is visible, and that the question does not come back afterwards.

The countdown is shown on /backups/remote for the WHOLE window - the bar
elsewhere is a nudge, this is the record, and a deletion date must be findable
on a quiet day too.

Tests: once-per-entry across a full settle-and-re-enter cycle; the banner
dismissal proven to be a session cookie (MaxAge 0, no Expires) and to persist
nothing; the opt-out proven to silence the banner while leaving the offer, the
route and the countdown untouched, and to remind again on a fresh entry; the
entry point surviving all three dismissals; a settled box showing nothing; and
the back-redirect refusing "//evil.example".

An existing test (TestRecovery_E) was updated: it asserted the legacy boolean,
which the epoch replaces. It now asserts the dismissal landed on the current
epoch, which is the stronger property.

Green: go build, go vet, go test ./... all pass; controller gates OK.

controller/internal/web/templates/layout.html

@@ -130,6 +130,37 @@
     </div>
 </div>
 {{end}}
+{{/* R-241 (v0.206.0) — the recovery reminder bar. Rendered while the situation holds, the customer
+     has not opted out of reminders for THIS situation, and they have not clicked it away this visit.
+     It NEVER replaces the entry point on the Távoli mentés page — silencing a reminder is not the
+     same as removing the route. */}}
+{{if .RecoveryBanner}}
+<div class="alerts-container">
+    <div class="alert-banner alert-banner-warning">
+        <span class="alert-icon"><svg class="ico"><use href="#i-triangle-alert"/></svg></span>
+        <span class="alert-message">
+            {{if .RecoveryAbandonDays}}
+            A korábbi távoli mentéseidet <strong>{{.RecoveryAbandonDays}} nap múlva</strong> ({{.RecoveryAbandonDate}}) véglegesen töröljük, a kérésed szerint. Addig még visszaszerezheted őket a helyreállítási kóddal.
+            {{else}}
+            A korábbi távoli mentéseid megvannak, de ehhez a géphez a helyreállítási kódod szükséges.
+            {{end}}
+            <a href="/recovery">Megnézem</a>
+        </span>
+        <span class="alert-actions">
+            <form method="POST" action="/recovery/banner/dismiss" style="display:inline">
+                {{.CSRFField}}<input type="hidden" name="back" value="{{.RecoveryBannerBack}}">
+                <button type="submit" class="btn btn-sm btn-outline">Most nem</button>
+            </form>
+            {{if not .RecoveryAbandonDays}}
+            <form method="POST" action="/recovery/remind-optout" style="display:inline">
+                {{.CSRFField}}<input type="hidden" name="back" value="{{.RecoveryBannerBack}}">
+                <button type="submit" class="btn btn-sm btn-outline">Ne emlékeztessen újra</button>
+            </form>
+            {{end}}
+        </span>
+    </div>
+</div>
+{{end}}
 {{if .Alerts}}
 <div class="alerts-container">
     {{range .Alerts}}