v0.315.0: one app page with four tabs; the guide the catalog can carry; no Raspberry Pi badge

An app was six pages — details, install/settings, logs, export, the per-app backup panel and a
details card for moving data — and every "Vissza" on them went to the app LIST, so there was no way
back to the app you were looking at. It is now ONE page with four tab URLs under /apps/{slug}/,
one shared header and one set of banners.

  settings  Mukodes (Start/Restart/Stop, Stop confirms) + the cards that want something from the
            household + the install-time and optional settings. The default for an installed app,
            RENDERED at the bare URL and never redirected to.
  data      the data folders, move to another drive, the nightly copy, the 2nd-copy setting, export
  guide     tagline, screenshots, use cases, first steps, the catalog's guide, the FAQ, the docs
            link — and the WHOLE page for an app that is not installed
  logs      the log, and the only tab whose poller runs

The tabs are links, not panels: a link in an alert has to land ON a tab, and the log poller must not
run on the other three. Start/Restart/Stop left the page header, where they read as menu buttons.

The old /stacks/{name}/{deploy,logs,export,backup} GETs answer 302 — never 301, which a browser
caches beyond anyone's reach — to the tab that now holds them, query string carried through, with
name->slug resolved through the stack list rather than assumed equal. Every POST on those paths is
untouched: the backup form, the app-email toggle and the reveal endpoints keep their URLs.

A value asked AFTER the app starts is now generic (D2). The catalog marks a field `after_start: true`
and supplies its label; the ACTION is Go, in a registry keyed by slug + env var. The catalog can
never declare what runs — a declared field with no registered action renders nothing, POSTs 404 and
logs one WARN with the env var KEY, never the value. A red-proof found the second half of that guard
unpinned: deleting the "the catalog must have DECLARED this field" check left the suite green, and a
POST for an undeclared field then reached Plex and opened the setup gate.
TestAfterStart_RegistryAloneIsNotAnInvitation pins it.

New catalog block app_info.guide (sections + faq + checked_version), parsed, localised field by
field and rendered with the household's own address filled in. It renders only when checked_version
names the image tag its author clicked through. No template carries one yet.

The Pi and "csak x86" badges are gone; PiCompatible and the catalog key stay this release, or a box
on 0.314.0 would read "csak x86" on every app (R-1067).

template_id_gate.py now follows {{template}} includes, with a scope decoy proving the walk did not
become vacuous.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0117kRTSgs3rJWUFGxyoWN6Y

controller/internal/stacks/metadata.go

@@ -166,6 +166,73 @@ type AppInfo struct {
 	DocsURL       string   `yaml:"docs_url" json:"docs_url"`
 	// AddPeople (v0.281.0, decision 47): how the household adds a family member once sign-up is closed.
 	AddPeople string `yaml:"add_people,omitempty" json:"add_people,omitempty"`
+	// Guide (v0.315.0): the app's own user guide, shown on the app page's „Utmutato" tab. Optional —
+	// an app with no guide block renders the tab's existing content and says a guide is still to come.
+	Guide AppGuide `yaml:"guide,omitempty" json:"guide,omitempty"`
+}
+
+// AppGuide is the catalog's user guide for one app: numbered sections and a FAQ, both plain text.
+//
+// CheckedVersion is NOT copy. It is the image tag the guide's author actually clicked through, and it
+// is the render gate: a guide whose author never named a version is not shown at all (an unchecked
+// guide that walks the household through a UI two releases old is worse than no guide). It is
+// deliberately absent from the overlay below — a translator does not get to vouch for a version.
+//
+// Sections and FAQ entries are PLAIN TEXT and reach the page through html/template's escaping. No
+// markdown, no raw HTML: catalog copy is data, and a step that contains `<script>` is shown as the
+// characters the author typed. Pinned by TestGuide_RenderRules.
+type AppGuide struct {
+	CheckedVersion string         `yaml:"checked_version,omitempty" json:"checked_version,omitempty"`
+	Sections       []GuideSection `yaml:"sections,omitempty" json:"sections,omitempty"`
+	FAQ            []GuideFAQ     `yaml:"faq,omitempty" json:"faq,omitempty"`
+}
+
+// GuideSection is one headed block of the guide: a title, an optional lead-in, and the steps.
+type GuideSection struct {
+	Title string   `yaml:"title" json:"title"`
+	Intro string   `yaml:"intro,omitempty" json:"intro,omitempty"`
+	Steps []string `yaml:"steps,omitempty" json:"steps,omitempty"`
+}
+
+// GuideFAQ is one question and its answer.
+type GuideFAQ struct {
+	Q string `yaml:"q" json:"q"`
+	A string `yaml:"a" json:"a"`
+}
+
+// Rendered reports whether this guide may be shown: its author named the version they checked it
+// against, AND there is something to show. Both halves matter — `checked_version` alone renders an
+// empty „Gyakori kerdesek" heading, and sections alone are a guide nobody vouched for.
+//
+// VALUE receiver: this type reaches html/template inside an interface{}, where a pointer-receiver
+// method is a render-time 500 (the trap is on file in this repo twice).
+func (g AppGuide) Rendered() bool {
+	return strings.TrimSpace(g.CheckedVersion) != "" && (len(g.Sections) > 0 || len(g.FAQ) > 0)
+}
+
+// Clone returns a copy sharing no slice with the receiver — the three in a guide are `Sections`,
+// `FAQ` and each section's `Steps`.
+//
+// It exists for deepCopyStack (R-591): a Stack copy is „a snapshot the caller may mutate", and
+// Metadata lives in the stack manager's cache shared by every request. TestDeepCopyStackMetaSharesNoReference
+// fills every pointer, slice and map reachable from Metadata and fails on any the copy still shares —
+// it caught these three the moment the guide was added, which is exactly what it is for.
+func (g AppGuide) Clone() AppGuide {
+	out := g
+	if g.Sections != nil {
+		out.Sections = make([]GuideSection, len(g.Sections))
+		copy(out.Sections, g.Sections)
+		for i, se := range g.Sections {
+			if se.Steps != nil {
+				out.Sections[i].Steps = append([]string(nil), se.Steps...)
+			}
+		}
+	}
+	if g.FAQ != nil {
+		out.FAQ = make([]GuideFAQ, len(g.FAQ))
+		copy(out.FAQ, g.FAQ)
+	}
+	return out
 }
 
 // OptionalConfigGroup defines a group of optional config fields (e.g., "Metadata providers").