R-542: the disk candidates no longer offer a registered, in-use drive

The format wizard rendered the agent's initialize list as-is, and the
agent deliberately allows re-initialising Felhom's own drives, so a
registered data drive was offered for formatting. The controller proxy
now drops every candidate that backs a registered storage path (joined
through the guest mount table) from both lists; an unreadable mount
table empties initialize.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/templates/storage_init.html

@@ -75,8 +75,8 @@ function fmtSize(b){
 async function loadDisks(){
   try{
     // Impl-2b: the raw-device scan (agent GET /disks/candidates via the controller proxy). The agent's
-    // unclaimed-disk filter already excludes OS/enrolled/claimed disks (fail-safe), so we trust the list
-    // as-is — no client-side filtering. `initialize` = every unclaimed disk (blank or data-bearing).
+    // unclaimed-disk filter excludes OS/claimed disks (fail-safe) and the proxy removes every drive behind a
+    // registered storage path (R-542), so we trust the list as-is — no client-side filtering. `initialize` = every unclaimed disk (blank or data-bearing).
     var r = await fetch('/api/disks/candidates'); var j = await r.json();
     if(!j.ok){ throw new Error(j.error||'{{T "storage_init.hiba"}}'); }
     var cands = (j.data&&j.data.initialize)||[];