R-970: the box's hub key opens no route; Data tab leftovers; R-1103: the install form's dead branches

R-970: /api/config, /api/config/hash, /api/config/apply removed (they read and replaced controller.yaml with
every secret, reachable with the box's own hub API key, unsigned; nothing called them). The hub-key Bearer
door on /api/selfupdate/ and /api/geo/ and the matching CSRF exemption are gone; the dashboard keeps using
those with a session. The route table is buildMux, so a test drives the real one.

Data tab: the export password field is autocomplete=new-password with a non-login name; the 2nd copy's
status rows that repeated the form are gone (the no-target reason moves into the form).

R-1103: app_fields.html loses its installed-only branches (no page serves them since R-1095); the tests
that rendered that dead path are retired, their rules asserted on the settings tab (R-694 moved there).

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/r694_restored_login_test.go

@@ -1,34 +1,45 @@
 package web
 
 import (
+	"net/http"
+	"path/filepath"
 	"strings"
 	"testing"
 
 	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
 )
 
-// R-694 (v0.275.0) — a deployed app whose admin login was GENERATED by a restore: the page shows no value
-// for it and says the old password is the one that works; an app without that record renders as before.
-// Rendered through the production template path (renderI18nCase), both languages.
-func TestR694_TheDeployPageDoesNotOfferAGeneratedLogin(t *testing.T) {
-	s := i18nTestServer(t)
-	base := func() map[string]interface{} { return i18nDeployData(true, stacks.StateRunning, 1) }
-	restored := func() map[string]interface{} {
-		d := base()
-		d["DeployedFieldValues"] = map[string]string{"SUBDOMAIN": "paste"} // the handler removed the value
-		d["RestoredLogins"] = map[string]bool{"ADMIN_PASSWORD": true}
-		return d
+// R-694 (v0.275.0) — an installed app whose admin login was GENERATED by a restore: the page shows no value and no eye
+// for it and says the old password is the one that works; an app without that record shows the eye.
+//
+// v0.322.0 (R-1103): moved from the install form (which no longer renders for an installed app, R-1095) to the settings
+// tab, through the production route (s.ServeHTTP) on a real stack manager.
+// RED-PROOF (2026-10-16, REPORT): with the `{{- if .Restored}}` branch removed from the login panel, this failed at
+// „the restored login is offered for reveal".
+func TestR694_TheSettingsTabDoesNotOfferAGeneratedLogin(t *testing.T) {
+	s := tuningHarness(t, tuningEnv())
+	dir := filepath.Join(s.cfg.Paths.StacksDir, "calibre-web")
+	if err := stacks.SaveAppConfig(dir, &stacks.AppConfig{Deployed: true, Env: tuningEnv(), RestoredLogins: []string{"ADMIN_PASSWORD"}}, nil, nil); err != nil {
+		t.Fatal(err)
 	}
-	hu := renderI18nCase(t, s, "hu", i18nCase{"r694", "deploy", restored})
-	if !strings.Contains(hu, "Mentésből töltötted vissza") || strings.Contains(hu, "rejtett érték") || strings.Contains(hu, "Telepítéskor beállított kezdeti jelszó") {
-		t.Fatalf("hu page does not say to use the old password, or still shows a value")
+	_ = s.stackMgr.ScanStacks()
+	rec := appGet(t, s, "/apps/calibre-web/settings")
+	if rec.Code != http.StatusOK {
+		t.Fatalf("GET settings = %d", rec.Code)
 	}
-	en := renderI18nCase(t, s, "en", i18nCase{"r694", "deploy", restored})
-	if !strings.Contains(en, "Restored from a backup: log in with the password that was valid when the backup was taken") {
-		t.Fatal("en page lacks the sentence")
+	body := rec.Body.String()
+	if strings.Contains(body, tuningPassword) {
+		t.Fatal("the restore-generated password is in the page")
 	}
-	plain := renderI18nCase(t, s, "hu", i18nCase{"r694-plain", "deploy", base})
-	if strings.Contains(plain, "Mentésből töltötted vissza") || !strings.Contains(plain, "Telepítéskor beállított kezdeti jelszó") {
-		t.Fatal("an app without restored_logins changed")
+	if strings.Contains(body, `data-login-reveal="ADMIN_PASSWORD"`) {
+		t.Fatal("the restored login is offered for reveal")
+	}
+	if !strings.Contains(body, `data-login-restored="ADMIN_PASSWORD"`) {
+		t.Fatal("the page does not say to use the old password")
+	}
+	// Control: without the record the same app offers the eye.
+	plain := tuningHarness(t, tuningEnv())
+	if b := appGet(t, plain, "/apps/calibre-web/settings").Body.String(); !strings.Contains(b, `data-login-reveal="ADMIN_PASSWORD"`) || strings.Contains(b, `data-login-restored`) {
+		t.Fatal("control: an app without restored_logins does not offer its eye")
 	}
 }