D1 Part 3 leftovers: remove 8 residual emoji + Python emoji gate

- The D0 grep gate false-negatived multibyte emoji on Windows (its zero
  was wrong). scripts/emoji_gate.py scans by Unicode codepoint; it found
  8 survivors: backups.html (📁→file-text icon, 🔄 restore-info text),
  debug.html (🔄→'fut', 🔒→'titkosított'), deploy.html (📦→upload icon,
  ★ default-marker → '(alapértelmezett)'), storage.html (📦→upload icon,
  📦 in the migrate-target option → plain text). All → sprite icons or
  plain words.
- Gates: scripts/emoji_gate.py = 0; new Go TestNoEmojiInTemplates
  codepoint scan keeps it enforced (allowlist: ✓✗✔✘•●○■▶ monochrome
  text marks). go build/vet/test ./... green (18 pkgs).

controller/internal/web/handlers.go

@@ -895,10 +895,19 @@ func (s *Server) backupRestoreHandler(w http.ResponseWriter, r *http.Request) {
 	http.Redirect(w, r, "/backups?flash="+msg, http.StatusFound)
 }
 
-func (s *Server) settingsData() map[string]interface{} {
-	data := s.baseData("settings", "Beállítások")
+// settingsBaseData is the shared identity block used by every settings-family subpage
+// (D1 split: /settings, /settings/notifications, /settings/security, /storage).
+func (s *Server) settingsBaseData(page, title string) map[string]interface{} {
+	data := s.baseData(page, title)
 	data["CustomerID"] = s.cfg.Customer.ID
 	data["CustomerDomain"] = s.cfg.Customer.Domain
+	return data
+}
+
+// systemPageData builds the Rendszer subpage: read-only configuration, version/update,
+// controller + server restart.
+func (s *Server) systemPageData() map[string]interface{} {
+	data := s.settingsBaseData("settings", "Beállítások")
 	data["GitRepoURL"] = s.cfg.Git.RepoURL
 	data["GitSyncInterval"] = s.cfg.Git.SyncInterval
 	data["BackupEnabled"] = s.cfg.Backup.Enabled
@@ -928,15 +937,13 @@ func (s *Server) settingsData() map[string]interface{} {
 		// to. Empty = none set by the operator.
 		data["ControllerFloor"] = s.updater.GetFloor()
 	}
+	return data
+}
 
-	data["NotificationPrefs"] = s.settings.GetNotificationPrefs()
-
-	// App-email (SMTP relay) — global toggle. Only meaningful when a hub is configured (the relay
-	// path runs through the hub); the template hides the control otherwise.
-	appEmail := s.settings.GetAppEmail()
-	data["AppEmailEnabled"] = appEmail.Enabled
-	data["AppEmailFromName"] = appEmail.FromName
-	data["AppEmailAvailable"] = s.cfg.Hub.URL != "" && s.cfg.MailRelay.HardEnabled()
+// storagePageData builds the Tárhely page: physical drive registry, NAS shares, and the
+// data the unified agent-enriched drive view needs.
+func (s *Server) storagePageData() map[string]interface{} {
+	data := s.settingsBaseData("storage", "Tárhely")
 
 	// Storage paths with display data
 	storagePaths := s.settings.GetStoragePaths()
@@ -983,6 +990,28 @@ func (s *Server) settingsData() map[string]interface{} {
 	// NAS network storage (Part A2) — separate section with the agent's per-share health (ok/idle/
 	// unreachable/unknown). Distinct from the physical-drive list above; no drive lifecycle actions.
 	data["NetworkStoragePaths"] = s.networkStorageItems(context.Background())
+	return data
+}
+
+// notificationsPageData builds the Értesítések subpage: notification prefs + app-email.
+func (s *Server) notificationsPageData() map[string]interface{} {
+	data := s.settingsBaseData("settings-notifications", "Értesítések")
+	data["HubEnabled"] = s.cfg.Hub.Enabled
+	data["NotificationPrefs"] = s.settings.GetNotificationPrefs()
+
+	// App-email (SMTP relay) — global toggle. Only meaningful when a hub is configured (the relay
+	// path runs through the hub); the template hides the control otherwise.
+	appEmail := s.settings.GetAppEmail()
+	data["AppEmailEnabled"] = appEmail.Enabled
+	data["AppEmailFromName"] = appEmail.FromName
+	data["AppEmailAvailable"] = s.cfg.Hub.URL != "" && s.cfg.MailRelay.HardEnabled()
+	return data
+}
+
+// securityPageData builds the Biztonság és hozzáférés subpage: password, geo-restriction,
+// emergency/recovery info.
+func (s *Server) securityPageData() map[string]interface{} {
+	data := s.settingsBaseData("settings-security", "Biztonság és hozzáférés")
 
 	// Recovery info for emergency section
 	data["RetrievalPassword"] = s.settings.GetRetrievalPassword()
@@ -1016,16 +1045,31 @@ func (s *Server) settingsData() map[string]interface{} {
 		})
 	}
 	data["DeployedApps"] = deployedApps
-
 	return data
 }
 
 func (s *Server) settingsHandler(w http.ResponseWriter, r *http.Request) {
-	data := s.settingsData()
+	s.executeTemplate(w, r, "settings_system", s.systemPageData())
+}
+
+// storagePageHandler serves the Tárhely main-nav page (D1). Storage action flashes land here.
+func (s *Server) storagePageHandler(w http.ResponseWriter, r *http.Request) {
+	data := s.storagePageData()
 	if msg := r.URL.Query().Get("storage_msg"); msg == "success" {
 		data["StorageSuccess"] = r.URL.Query().Get("storage_detail")
 	}
-	s.executeTemplate(w, r, "settings", data)
+	s.executeTemplate(w, r, "storage", data)
+}
+
+// settingsNotificationsPageHandler serves GET /settings/notifications (the POST on the same
+// path is the save handler — dispatch is split in the router).
+func (s *Server) settingsNotificationsPageHandler(w http.ResponseWriter, r *http.Request) {
+	s.executeTemplate(w, r, "settings_notifications", s.notificationsPageData())
+}
+
+// settingsSecurityPageHandler serves GET /settings/security.
+func (s *Server) settingsSecurityPageHandler(w http.ResponseWriter, r *http.Request) {
+	s.executeTemplate(w, r, "settings_security", s.securityPageData())
 }
 
 func (s *Server) settingsPasswordHandler(w http.ResponseWriter, r *http.Request) {
@@ -1038,7 +1082,7 @@ func (s *Server) settingsPasswordHandler(w http.ResponseWriter, r *http.Request)
 		s.logger.Printf("[DEBUG] [web] settingsPasswordHandler: password change attempt from %s", r.RemoteAddr)
 	}
 
-	data := s.settingsData()
+	data := s.securityPageData()
 
 	// Validate current password
 	effectiveHash := s.effectivePasswordHash()
@@ -1047,21 +1091,21 @@ func (s *Server) settingsPasswordHandler(w http.ResponseWriter, r *http.Request)
 			s.logger.Printf("[DEBUG] [web] settingsPasswordHandler: current password mismatch from %s", r.RemoteAddr)
 		}
 		data["PasswordError"] = "Hibás jelenlegi jelszó"
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "settings_security", data)
 		return
 	}
 
 	// Validate new password length
 	if len(newPassword) < 8 {
 		data["PasswordError"] = "A jelszónak legalább 8 karakter hosszúnak kell lennie"
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "settings_security", data)
 		return
 	}
 
 	// Validate passwords match
 	if newPassword != confirmPassword {
 		data["PasswordError"] = "A két jelszó nem egyezik"
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "settings_security", data)
 		return
 	}
 
@@ -1070,7 +1114,7 @@ func (s *Server) settingsPasswordHandler(w http.ResponseWriter, r *http.Request)
 	if err != nil {
 		s.logger.Printf("[ERROR] [web] Failed to hash new password: %v", err)
 		data["PasswordError"] = "Belső hiba a jelszó mentésekor"
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "settings_security", data)
 		return
 	}
 
@@ -1078,7 +1122,7 @@ func (s *Server) settingsPasswordHandler(w http.ResponseWriter, r *http.Request)
 	if err := s.settings.SetPasswordHash(string(hash)); err != nil {
 		s.logger.Printf("[ERROR] [web] Failed to save password to settings.json: %v", err)
 		data["PasswordError"] = "Belső hiba a jelszó mentésekor"
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "settings_security", data)
 		return
 	}
 
@@ -1143,16 +1187,16 @@ func (s *Server) settingsNotificationsHandler(w http.ResponseWriter, r *http.Req
 
 	if err := s.settings.SetNotificationPrefs(prefs); err != nil {
 		s.logger.Printf("[ERROR] [web] Failed to save notification prefs: %v", err)
-		data := s.settingsData()
+		data := s.notificationsPageData()
 		data["NotificationError"] = "Hiba a beállítások mentésekor"
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "settings_notifications", data)
 		return
 	}
 
 	s.logger.Printf("[INFO] [web] Notification preferences updated: email=%s, events=%v", email, enabledEvents)
 
 	// Sync preferences to hub
-	data := s.settingsData()
+	data := s.notificationsPageData()
 	if s.notifier != nil && s.notifier.IsEnabled() {
 		if err := s.notifier.SyncPreferences(email, enabledEvents, cooldownHours); err != nil {
 			s.logger.Printf("[WARN] [web] Failed to sync preferences to hub: %v", err)
@@ -1163,7 +1207,7 @@ func (s *Server) settingsNotificationsHandler(w http.ResponseWriter, r *http.Req
 	} else {
 		data["NotificationSuccess"] = "Értesítési beállítások mentve."
 	}
-	s.executeTemplate(w, r, "settings", data)
+	s.executeTemplate(w, r, "settings_notifications", data)
 }
 
 // settingsAppEmailHandler saves the global app-email toggle and starts/stops the on-box
@@ -1173,39 +1217,39 @@ func (s *Server) settingsAppEmailHandler(w http.ResponseWriter, r *http.Request)
 	enabled := r.FormValue("app_email_enabled") == "on" || r.FormValue("app_email_enabled") == "true"
 	fromName := strings.TrimSpace(r.FormValue("app_email_from_name"))
 
-	data := s.settingsData()
+	data := s.notificationsPageData()
 	if err := s.settings.SetAppEmail(enabled, fromName); err != nil {
 		s.logger.Printf("[ERROR] [web] Failed to save app-email toggle: %v", err)
 		data["AppEmailError"] = "Hiba az alkalmazás-email beállítás mentésekor"
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "settings_notifications", data)
 		return
 	}
 	// Reconcile the shim's running state with the new toggle.
 	if s.mailShim != nil {
 		if err := s.mailShim.Apply(enabled); err != nil {
 			s.logger.Printf("[ERROR] [web] app-email shim could not be %s: %v", map[bool]string{true: "started", false: "stopped"}[enabled], err)
-			data = s.settingsData()
+			data = s.notificationsPageData()
 			data["AppEmailError"] = "A beállítás elmentve, de az email-szolgáltatás indítása nem sikerült."
-			s.executeTemplate(w, r, "settings", data)
+			s.executeTemplate(w, r, "settings_notifications", data)
 			return
 		}
 	}
 	s.logger.Printf("[INFO] [web] App-email globally %s (from_name=%q)", map[bool]string{true: "enabled", false: "disabled"}[enabled], fromName)
-	data = s.settingsData()
+	data = s.notificationsPageData()
 	if enabled {
 		data["AppEmailSuccess"] = "Alkalmazás-email bekapcsolva. Kapcsold be az egyes alkalmazásoknál is, ahol email-küldést szeretnél."
 	} else {
 		data["AppEmailSuccess"] = "Alkalmazás-email kikapcsolva."
 	}
-	s.executeTemplate(w, r, "settings", data)
+	s.executeTemplate(w, r, "settings_notifications", data)
 }
 
 func (s *Server) settingsNotificationsTestHandler(w http.ResponseWriter, r *http.Request) {
-	data := s.settingsData()
+	data := s.notificationsPageData()
 
 	if s.notifier == nil {
 		data["NotificationError"] = "Az értesítések nincsenek bekapcsolva"
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "settings_notifications", data)
 		return
 	}
 
@@ -1213,12 +1257,12 @@ func (s *Server) settingsNotificationsTestHandler(w http.ResponseWriter, r *http
 	if err != nil {
 		s.logger.Printf("[ERROR] [web] Test notification failed: %v", err)
 		data["NotificationError"] = fmt.Sprintf("Teszt email küldése sikertelen: %v", err)
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "settings_notifications", data)
 		return
 	}
 
 	data["NotificationSuccess"] = "Teszt email elküldve."
-	s.executeTemplate(w, r, "settings", data)
+	s.executeTemplate(w, r, "settings_notifications", data)
 }
 
 // --- Storage path management handlers ---
@@ -1437,27 +1481,27 @@ func (s *Server) settingsStorageAddHandler(w http.ResponseWriter, r *http.Reques
 		label = settings.InferStorageLabel(path)
 	}
 
-	data := s.settingsData()
+	data := s.storagePageData()
 
 	// 1. Exists and is directory
 	fi, err := os.Stat(path)
 	if err != nil || !fi.IsDir() {
 		data["StorageError"] = "Az útvonal nem létezik vagy nem mappa."
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "storage", data)
 		return
 	}
 
 	// 2. Is mount point
 	if !system.IsMountPoint(path) {
 		data["StorageError"] = "Ez az útvonal nem külön csatlakoztatott meghajtó. Adatok az SSD-re kerülnének!"
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "storage", data)
 		return
 	}
 
 	// 3. Writable
 	if !system.IsWritable(path) {
 		data["StorageError"] = "Az útvonal nem írható."
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "storage", data)
 		return
 	}
 
@@ -1465,7 +1509,7 @@ func (s *Server) settingsStorageAddHandler(w http.ResponseWriter, r *http.Reques
 	for _, existing := range s.settings.GetStoragePaths() {
 		if system.PathsOverlap(path, existing.Path) {
 			data["StorageError"] = fmt.Sprintf("Az útvonal átfedi a már regisztrált %s útvonalat.", existing.Path)
-			s.executeTemplate(w, r, "settings", data)
+			s.executeTemplate(w, r, "storage", data)
 			return
 		}
 	}
@@ -1486,13 +1530,13 @@ func (s *Server) settingsStorageAddHandler(w http.ResponseWriter, r *http.Reques
 	if err := s.settings.AddStoragePath(sp); err != nil {
 		s.logger.Printf("[ERROR] [web] Failed to add storage path: %v", err)
 		data["StorageError"] = "Hiba a mentés során."
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "storage", data)
 		return
 	}
 
 	s.logger.Printf("[INFO] [web] Storage path added: %s (%s)", path, label)
 	go s.SyncFileBrowserMounts()
-	http.Redirect(w, r, "/settings?storage_msg=success&storage_detail="+url.QueryEscape("Adattároló sikeresen hozzáadva: "+path), http.StatusFound)
+	http.Redirect(w, r, "/storage?storage_msg=success&storage_detail="+url.QueryEscape("Adattároló sikeresen hozzáadva: "+path), http.StatusFound)
 }
 
 func (s *Server) settingsStorageRemoveHandler(w http.ResponseWriter, r *http.Request) {
@@ -1503,13 +1547,13 @@ func (s *Server) settingsStorageRemoveHandler(w http.ResponseWriter, r *http.Req
 		s.logger.Printf("[DEBUG] [web] settingsStorageRemoveHandler: path=%s from %s", path, r.RemoteAddr)
 	}
 
-	data := s.settingsData()
+	data := s.storagePageData()
 
 	// Check: apps using this path
 	apps := s.appsUsingPath(path)
 	if len(apps) > 0 {
 		data["StorageError"] = fmt.Sprintf("Nem törölhető: az alábbi alkalmazások használják: %s", strings.Join(apps, ", "))
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "storage", data)
 		return
 	}
 
@@ -1517,7 +1561,7 @@ func (s *Server) settingsStorageRemoveHandler(w http.ResponseWriter, r *http.Req
 	for _, sp := range s.settings.GetStoragePaths() {
 		if sp.Path == path && sp.IsDefault {
 			data["StorageError"] = "Az alapértelmezett adattároló nem törölhető."
-			s.executeTemplate(w, r, "settings", data)
+			s.executeTemplate(w, r, "storage", data)
 			return
 		}
 	}
@@ -1525,20 +1569,20 @@ func (s *Server) settingsStorageRemoveHandler(w http.ResponseWriter, r *http.Req
 	// Check: last path
 	if len(s.settings.GetStoragePaths()) <= 1 {
 		data["StorageError"] = "Az utolsó adattároló nem törölhető."
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "storage", data)
 		return
 	}
 
 	if err := s.settings.RemoveStoragePath(path); err != nil {
 		data["StorageError"] = "Hiba a törlés során."
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "storage", data)
 		return
 	}
 
 	s.logger.Printf("[INFO] [web] Storage path removed: %s", path)
 	// Sync FileBrowser mounts after storage path removal
 	go s.SyncFileBrowserMounts()
-	http.Redirect(w, r, "/settings?storage_msg=success&storage_detail="+url.QueryEscape("Adattároló eltávolítva: "+path), http.StatusFound)
+	http.Redirect(w, r, "/storage?storage_msg=success&storage_detail="+url.QueryEscape("Adattároló eltávolítva: "+path), http.StatusFound)
 }
 
 func (s *Server) settingsStorageDefaultHandler(w http.ResponseWriter, r *http.Request) {
@@ -1551,11 +1595,11 @@ func (s *Server) settingsStorageDefaultHandler(w http.ResponseWriter, r *http.Re
 
 	if err := s.settings.SetDefaultStoragePath(path); err != nil {
 		s.logger.Printf("[ERROR] [web] Failed to set default storage path: %v", err)
-		http.Redirect(w, r, "/settings", http.StatusFound)
+		http.Redirect(w, r, "/storage", http.StatusFound)
 		return
 	}
 	s.logger.Printf("[INFO] [web] Default storage path set to %s", path)
-	http.Redirect(w, r, "/settings?storage_msg=success&storage_detail="+url.QueryEscape("Alapértelmezett adattároló beállítva: "+path), http.StatusFound)
+	http.Redirect(w, r, "/storage?storage_msg=success&storage_detail="+url.QueryEscape("Alapértelmezett adattároló beállítva: "+path), http.StatusFound)
 }
 
 func (s *Server) settingsStorageSchedulableHandler(w http.ResponseWriter, r *http.Request) {
@@ -1569,11 +1613,11 @@ func (s *Server) settingsStorageSchedulableHandler(w http.ResponseWriter, r *htt
 
 	if err := s.settings.SetSchedulable(path, schedulable); err != nil {
 		s.logger.Printf("[ERROR] [web] Failed to update schedulable: %v", err)
-		http.Redirect(w, r, "/settings", http.StatusFound)
+		http.Redirect(w, r, "/storage", http.StatusFound)
 		return
 	}
 	s.logger.Printf("[INFO] [web] Storage schedulable updated: %s → %v", path, schedulable)
-	http.Redirect(w, r, "/settings?storage_msg=success&storage_detail="+url.QueryEscape("Adattároló állapot módosítva: "+path), http.StatusFound)
+	http.Redirect(w, r, "/storage?storage_msg=success&storage_detail="+url.QueryEscape("Adattároló állapot módosítva: "+path), http.StatusFound)
 }
 
 func (s *Server) settingsStorageLabelHandler(w http.ResponseWriter, r *http.Request) {
@@ -1586,22 +1630,22 @@ func (s *Server) settingsStorageLabelHandler(w http.ResponseWriter, r *http.Requ
 	}
 
 	if label == "" || len(label) > 50 {
-		data := s.settingsData()
+		data := s.storagePageData()
 		data["StorageError"] = "A megnevezés nem lehet üres és legfeljebb 50 karakter."
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "storage", data)
 		return
 	}
 
 	if err := s.settings.SetStorageLabel(path, label); err != nil {
 		s.logger.Printf("[ERROR] [web] Failed to set storage label: %v", err)
-		data := s.settingsData()
+		data := s.storagePageData()
 		data["StorageError"] = "Hiba a megnevezés mentésekor."
-		s.executeTemplate(w, r, "settings", data)
+		s.executeTemplate(w, r, "storage", data)
 		return
 	}
 
 	s.logger.Printf("[INFO] [web] Storage label updated: %s → %q", path, label)
-	http.Redirect(w, r, "/settings?storage_msg=success&storage_detail="+url.QueryEscape("Megnevezés módosítva: "+label), http.StatusFound)
+	http.Redirect(w, r, "/storage?storage_msg=success&storage_detail="+url.QueryEscape("Megnevezés módosítva: "+label), http.StatusFound)
 }
 
 // SyncFileBrowserMounts regenerates FileBrowser's docker-compose.yml and config.yaml

controller/internal/web/server.go

@@ -262,6 +262,12 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		s.monitoringHandler(w, r)
 	case path == "/settings":
 		s.settingsHandler(w, r)
+	case path == "/storage" && r.Method == http.MethodGet:
+		s.storagePageHandler(w, r)
+	case path == "/settings/notifications" && r.Method == http.MethodGet:
+		s.settingsNotificationsPageHandler(w, r)
+	case path == "/settings/security" && r.Method == http.MethodGet:
+		s.settingsSecurityPageHandler(w, r)
 	case path == "/settings/password" && r.Method == http.MethodPost:
 		s.settingsPasswordHandler(w, r)
 	case path == "/settings/notifications" && r.Method == http.MethodPost:
@@ -280,10 +286,15 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		s.settingsStorageSchedulableHandler(w, r)
 	case path == "/settings/storage/label" && r.Method == http.MethodPost:
 		s.settingsStorageLabelHandler(w, r)
-	case path == "/settings/storage/init" && r.Method == http.MethodGet:
+	case path == "/storage/init" && r.Method == http.MethodGet:
 		s.storageWizardPageHandler(w, r, "storage_init")
-	case path == "/settings/storage/attach" && r.Method == http.MethodGet:
+	case path == "/storage/attach" && r.Method == http.MethodGet:
 		s.storageWizardPageHandler(w, r, "storage_attach")
+	// D1: the wizard pages moved under /storage — permanent redirects keep old links working.
+	case path == "/settings/storage/init" && r.Method == http.MethodGet:
+		http.Redirect(w, r, "/storage/init", http.StatusMovedPermanently)
+	case path == "/settings/storage/attach" && r.Method == http.MethodGet:
+		http.Redirect(w, r, "/storage/attach", http.StatusMovedPermanently)
 	case path == "/backup/restore" && r.Method == http.MethodPost:
 		s.backupRestoreHandler(w, r)
 	// Off-box (NAS) restic-SFTP backup (Part B)

controller/internal/web/settings_split_test.go

@@ -0,0 +1,292 @@
+package web
+
+import (
+	"io"
+	"log"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"path/filepath"
+	"regexp"
+	"strings"
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/stacks"
+)
+
+// testPageServer builds a Server complete enough to render full pages through ServeHTTP
+// (templates loaded, settings + stack manager real, agent/hub absent).
+func testPageServer(t *testing.T) *Server {
+	t.Helper()
+	lg := log.New(io.Discard, "", 0)
+	dir := t.TempDir()
+	cfg := &config.Config{}
+	cfg.Customer.ID = "test-customer"
+	cfg.Customer.Name = "Teszt Ügyfél"
+	cfg.Customer.Domain = "example.hu"
+	cfg.Paths.StacksDir = filepath.Join(dir, "stacks")
+	cfg.Paths.DataDir = filepath.Join(dir, "data")
+	cfg.Stacks.ComposeCommand = "docker compose" // skip detection (not needed for page renders)
+
+	sett, err := settings.Load(filepath.Join(dir, "settings.json"), lg)
+	if err != nil {
+		t.Fatalf("settings: %v", err)
+	}
+	mgr, err := stacks.NewManager(cfg, lg)
+	if err != nil {
+		t.Fatalf("stacks manager: %v", err)
+	}
+	s := &Server{cfg: cfg, settings: sett, stackMgr: mgr, logger: lg, version: "test"}
+	s.loadTemplates()
+	return s
+}
+
+func getPage(t *testing.T, s *Server, path string) *httptest.ResponseRecorder {
+	t.Helper()
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodGet, path, nil)
+	s.ServeHTTP(rec, req)
+	return rec
+}
+
+// TestSettingsSplitPagesRender (D1 Scenario A): each page responds 200, carries its own
+// sections, and does NOT carry another page's sections (no cross-leak).
+func TestSettingsSplitPagesRender(t *testing.T) {
+	s := testPageServer(t)
+	cases := []struct {
+		path    string
+		must    []string
+		mustNot []string
+	}{
+		{"/settings",
+			[]string{"Rendszer konfiguráció", "Verzió és frissítés", "Vezérlő újraindítása", "Kiszolgáló újraindítása"},
+			[]string{"Adattárolók", "Jelszó módosítás", "Értesítési szünet"}},
+		{"/settings/notifications",
+			[]string{"Beállítások — Értesítések"},
+			[]string{"Rendszer konfiguráció", "Adattárolók", "Jelszó módosítás"}},
+		{"/settings/security",
+			[]string{"Jelszó módosítás", "Földrajzi korlátozás"},
+			[]string{"Rendszer konfiguráció", "Adattárolók", "Értesítési szünet"}},
+		{"/storage",
+			[]string{"Adattárolók", "Hálózati tárhely (NAS)"},
+			[]string{"Rendszer konfiguráció", "Jelszó módosítás", "Értesítési szünet"}},
+	}
+	for _, c := range cases {
+		rec := getPage(t, s, c.path)
+		if rec.Code != 200 {
+			t.Errorf("GET %s = %d, want 200", c.path, rec.Code)
+			continue
+		}
+		body := rec.Body.String()
+		for _, m := range c.must {
+			if !strings.Contains(body, m) {
+				t.Errorf("GET %s: missing section %q", c.path, m)
+			}
+		}
+		for _, m := range c.mustNot {
+			if strings.Contains(body, m) {
+				t.Errorf("GET %s: leaked foreign section %q", c.path, m)
+			}
+		}
+	}
+}
+
+// TestSettingsSectionInventory (D1 §10): every h3 section of the pre-split settings.html is
+// accounted for in the UNION of the four split templates (one deliberate rename noted).
+func TestSettingsSectionInventory(t *testing.T) {
+	oldHeadings := []string{
+		"Rendszer konfiguráció",
+		"Verzió és frissítés",
+		"Adattárolók",
+		"Hálózati tárhely (NAS)",
+		"Földrajzi korlátozás",
+		"Jelszó módosítás",
+		"Értesítések",
+		"Alkalmazás-email",
+		"Vészhelyzeti információk", // renamed from the misspelled "Veszhelyzeti informaciok"
+		"Vezérlő újraindítása",
+		"Kiszolgáló újraindítása",
+	}
+	var union strings.Builder
+	for _, f := range []string{"settings_system.html", "settings_notifications.html", "settings_security.html", "storage.html"} {
+		b, err := templateFS.ReadFile("templates/" + f)
+		if err != nil {
+			t.Fatalf("read %s: %v", f, err)
+		}
+		union.Write(b)
+	}
+	u := union.String()
+	for _, h := range oldHeadings {
+		if !strings.Contains(u, h) {
+			t.Errorf("old settings section %q missing from the union of the split templates", h)
+		}
+	}
+	if strings.Contains(u, "Veszhelyzeti informaciok") {
+		t.Error("the misspelled heading survived the split")
+	}
+}
+
+// TestWizardRoutesMovedWith301 (D1 Scenario E): old wizard URLs permanently redirect.
+func TestWizardRoutesMovedWith301(t *testing.T) {
+	s := testPageServer(t)
+	cases := map[string]string{
+		"/settings/storage/init":   "/storage/init",
+		"/settings/storage/attach": "/storage/attach",
+	}
+	for old, want := range cases {
+		rec := getPage(t, s, old)
+		if rec.Code != http.StatusMovedPermanently {
+			t.Errorf("GET %s = %d, want 301", old, rec.Code)
+		}
+		if loc := rec.Header().Get("Location"); loc != want {
+			t.Errorf("GET %s Location = %q, want %q", old, loc, want)
+		}
+	}
+	// and the new URLs render
+	for _, p := range []string{"/storage/init", "/storage/attach"} {
+		if rec := getPage(t, s, p); rec.Code != 200 {
+			t.Errorf("GET %s = %d, want 200", p, rec.Code)
+		}
+	}
+}
+
+// TestStorageActionRedirectsToStorage (D1 Scenario D): storage POST successes land on
+// /storage?storage_msg=..., and the flash renders there.
+func TestStorageActionRedirectsToStorage(t *testing.T) {
+	s := testPageServer(t)
+	if err := s.settings.AddStoragePath(settings.StoragePath{Path: "/mnt/test-drive", Label: "Teszt", Schedulable: true}); err != nil {
+		t.Fatalf("add path: %v", err)
+	}
+
+	form := url.Values{"storage_path": {"/mnt/test-drive"}, "storage_label": {"Új Név"}}
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, "/settings/storage/label", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	s.settingsStorageLabelHandler(rec, req)
+
+	if rec.Code != http.StatusFound {
+		t.Fatalf("label POST = %d, want 302", rec.Code)
+	}
+	loc := rec.Header().Get("Location")
+	if !strings.HasPrefix(loc, "/storage?storage_msg=success") {
+		t.Errorf("Location = %q, want prefix /storage?storage_msg=success", loc)
+	}
+
+	// The flash renders on /storage
+	rec2 := getPage(t, s, loc)
+	if rec2.Code != 200 {
+		t.Fatalf("GET %s = %d, want 200", loc, rec2.Code)
+	}
+	if !strings.Contains(rec2.Body.String(), "Megnevezés módosítva") {
+		t.Errorf("/storage did not render the storage flash message")
+	}
+}
+
+// TestPasswordErrorRerendersSecurityPage (D1 Scenario D): a wrong current password
+// re-renders the page carrying the password form with the inline error.
+func TestPasswordErrorRerendersSecurityPage(t *testing.T) {
+	s := testPageServer(t)
+	// enable auth so the password form path is active
+	if err := s.settings.SetPasswordHash("$2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy"); err != nil { // "password"
+		t.Fatalf("set hash: %v", err)
+	}
+	form := url.Values{
+		"current_password": {"wrong-password"},
+		"new_password":     {"newpassword123"},
+		"confirm_password": {"newpassword123"},
+	}
+	rec := httptest.NewRecorder()
+	req := httptest.NewRequest(http.MethodPost, "/settings/password", strings.NewReader(form.Encode()))
+	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
+	s.settingsPasswordHandler(rec, req)
+
+	if rec.Code != 200 {
+		t.Fatalf("password POST = %d, want 200 (inline error re-render)", rec.Code)
+	}
+	body := rec.Body.String()
+	if !strings.Contains(body, "Hibás jelenlegi jelszó") {
+		t.Error("missing inline error 'Hibás jelenlegi jelszó'")
+	}
+	if !strings.Contains(body, "Jelszó módosítás") {
+		t.Error("re-rendered page lacks the password form section")
+	}
+}
+
+// TestStorageNoNativeConfirm (D1 Scenario F): the four split templates contain no native
+// confirm()/prompt() — all consequential actions route through the overlay.
+func TestStorageNoNativeConfirm(t *testing.T) {
+	nativeRe := regexp.MustCompile(`(^|[^A-Za-z_.])(confirm|prompt)\(`)
+	// allow the pre-existing type-to-confirm overlay helper names
+	allow := regexp.MustCompile(`openConfirm|__closeConfirm|confirmEject|confirmWipe|typeToConfirm|confirm-`)
+	for _, f := range []string{"storage.html", "settings_system.html", "settings_notifications.html", "settings_security.html"} {
+		b, err := templateFS.ReadFile("templates/" + f)
+		if err != nil {
+			t.Fatalf("read %s: %v", f, err)
+		}
+		for i, line := range strings.Split(string(b), "\n") {
+			if nativeRe.MatchString(line) && !allow.MatchString(line) {
+				t.Errorf("%s:%d native confirm/prompt: %s", f, i+1, strings.TrimSpace(line))
+			}
+		}
+	}
+}
+
+// TestStorageAgentDownNote (D1 Scenario C, static): the enrichment JS has an error path that
+// renders the exact warn note into #agent-warn-note (graceful degradation when the agent is down).
+func TestStorageAgentDownNote(t *testing.T) {
+	b, err := templateFS.ReadFile("templates/storage.html")
+	if err != nil {
+		t.Fatal(err)
+	}
+	body := string(b)
+	if !strings.Contains(body, `id="agent-warn-note"`) {
+		t.Error("missing #agent-warn-note element")
+	}
+	if !strings.Contains(body, "Az ügynök nem elérhető") {
+		t.Error("missing the agent-unreachable warn text")
+	}
+	// the catch block must target the note element
+	if !strings.Contains(body, "warn.innerHTML=") {
+		t.Error("enrichment JS lacks the warn-note error path")
+	}
+}
+
+// TestNoEmojiInTemplates (D1 §10, Group G): no emoji/pictographs in web templates. Go-side
+// codepoint scan (the D0 grep-based gate false-negatived multibyte emoji on Windows).
+func TestNoEmojiInTemplates(t *testing.T) {
+	allow := map[rune]bool{}
+	for _, r := range "✓✗✔✘•●○■▶" {
+		allow[r] = true
+	}
+	isEmoji := func(r rune) bool {
+		if allow[r] {
+			return false
+		}
+		switch {
+		case r >= 0x1F300 && r <= 0x1FAFF,
+			r >= 0x2600 && r <= 0x26FF,
+			r >= 0x2700 && r <= 0x27BF,
+			r >= 0xFE00 && r <= 0xFE0F,
+			r >= 0x1F1E6 && r <= 0x1F1FF:
+			return true
+		}
+		return false
+	}
+	entries, _ := templateFS.ReadDir("templates")
+	for _, e := range entries {
+		if !strings.HasSuffix(e.Name(), ".html") {
+			continue
+		}
+		b, err := templateFS.ReadFile("templates/" + e.Name())
+		if err != nil {
+			t.Fatal(err)
+		}
+		for _, r := range string(b) {
+			if isEmoji(r) {
+				t.Errorf("%s contains emoji %q (U+%04X)", e.Name(), r, r)
+			}
+		}
+	}
+}

controller/internal/web/templates/backups.html

@@ -434,7 +434,7 @@
                         {{end}}
                         {{if .Tier2SizeHuman}}<span class="tier-size">{{.Tier2SizeHuman}}</span>{{end}}
                         <span class="tier-contents">{{.BackupContents}}</span>
-                        <span class="tier-browsable" title="A mentés böngészhető fájlrendszerben">📁</span>
+                        <span class="tier-browsable" title="A mentés böngészhető fájlrendszerben"><svg class="ico ico-sm"><use href="#i-file-text"/></svg></span>
                         <div class="layer-actions">
                             <a href="/stacks/{{.StackName}}/backup" class="btn btn-xs btn-outline">Beállítás</a>
                         </div>
@@ -743,7 +743,7 @@ function onRestoreAppChange() {
     var hasVolumes = opt.getAttribute('data-has-volumes') === 'true';
 
     if (hasHDD || hasVolumes) {
-        typeInfo.innerHTML = '🔄 Teljes visszaállítás: adatbázis + konfiguráció + felhasználói adatok a kiválasztott pillanatképből.';
+        typeInfo.innerHTML = 'Teljes visszaállítás: adatbázis + konfiguráció + felhasználói adatok a kiválasztott pillanatképből.';
         typeInfo.className = 'restore-info';
     } else if (hasDB) {
         typeInfo.innerHTML = 'Adatbázis és konfiguráció visszaállítása — az alkalmazásnak nincs külön felhasználói adata.';

controller/internal/web/templates/debug.html

@@ -362,7 +362,7 @@ function renderDiagnostic(d) {
         html += '<h4 style="margin-top:.75rem">Ütemező</h4><table class="info-table debug-table"><tr><th>Név</th><th>Típus</th><th>Utolsó futás</th><th>Fut</th></tr>';
         d.scheduler.forEach(function(j) {
             var type = j.type === 'daily' ? j.schedule : (j.interval || '-');
-            html += '<tr><td>' + j.name + '</td><td>' + type + '</td><td>' + (j.last_run ? fmtTime(j.last_run) : '-') + '</td><td>' + (j.running ? '🔄' : '-') + '</td></tr>';
+            html += '<tr><td>' + j.name + '</td><td>' + type + '</td><td>' + (j.last_run ? fmtTime(j.last_run) : '-') + '</td><td>' + (j.running ? 'fut' : '-') + '</td></tr>';
         });
         html += '</table>';
     }
@@ -835,7 +835,7 @@ function renderAppBundles(bundles) {
         html += '<td>' + (b.exported_at || '-') + '</td>';
         html += '<td>' + (b.size_human || '-') + '</td>';
         html += '<td>' + escapeHtml(b.drive_label || b.drive_path) + '</td>';
-        html += '<td>' + (b.encrypted ? '🔒' : '-') + '</td>';
+        html += '<td>' + (b.encrypted ? 'titkosított' : '-') + '</td>';
         html += '<td>' + (b.has_db ? 'igen' : '-') + '</td>';
         html += '<td>' + (b.needs_hdd ? 'igen' : '-') + '</td>';
         html += '<td class="mono" style="font-size:.7rem;max-width:200px;overflow:hidden;text-overflow:ellipsis">' + escapeHtml(b.path) + '</td>';

controller/internal/web/templates/deploy.html

@@ -69,7 +69,7 @@
         </div>
         {{if .OtherStoragePaths}}
         <span class="btn btn-sm btn-outline" style="margin-top:.75rem;opacity:.45;cursor:not-allowed" title="Hamarosan">
-            📦 Mozgatás másik tárolóra
+            <svg class="ico ico-sm"><use href="#i-upload"/></svg> Mozgatás másik tárolóra
         </span>
         {{end}}
     </div>
@@ -565,7 +565,7 @@
                     {{range $.StoragePaths}}
                     <option value="{{.Path}}" data-free-percent="{{printf "%.0f" .FreePercent}}"
                             {{if .IsDefault}}selected{{end}}>
-                        {{.Label}} — {{.FreeHuman}} szabad{{if .IsDefault}} ★{{end}}
+                        {{.Label}} — {{.FreeHuman}} szabad{{if .IsDefault}} (alapértelmezett){{end}}
                     </option>
                     {{end}}
                 </select>

controller/internal/web/templates/layout.html

@@ -23,12 +23,18 @@
         <ul class="nav-links">
             <li><a href="/" class="{{if eq .Page "dashboard"}}active{{end}}"><svg class="ico"><use href="#i-layout-grid"/></svg>Vezérlőpult</a></li>
             <li><a href="/stacks" class="{{if eq .Page "stacks"}}active{{end}}"><svg class="ico"><use href="#i-cloud"/></svg>Alkalmazások</a></li>
+            <li><a href="/storage" class="{{if eq .Page "storage"}}active{{end}}"><svg class="ico"><use href="#i-hard-drive"/></svg>Tárhely</a></li>
             <li><a href="/backups" class="{{if eq .Page "backups"}}active{{end}}"><svg class="ico"><use href="#i-shield"/></svg>Biztonsági mentés</a></li>
             <li><a href="/monitoring" class="{{if eq .Page "monitoring"}}active{{end}}"><svg class="ico"><use href="#i-cpu"/></svg>Rendszermonitor</a></li>
             {{if .DebugMode}}<li><a href="/debug" class="{{if eq .Page "debug"}}active{{end}}"><svg class="ico"><use href="#i-wrench"/></svg>Debug</a></li>{{end}}
         </ul>
         <div class="sidebar-bottom">
-            <a href="/settings" class="sidebar-settings-link {{if eq .Page "settings"}}active{{end}}"><svg class="ico"><use href="#i-settings"/></svg>Beállítások</a>
+            <div class="nav-group-label">Beállítások</div>
+            <ul class="nav-links nav-links-sub">
+                <li><a href="/settings" class="{{if eq .Page "settings"}}active{{end}}"><svg class="ico"><use href="#i-settings"/></svg>Rendszer</a></li>
+                <li><a href="/settings/notifications" class="{{if eq .Page "settings-notifications"}}active{{end}}"><svg class="ico"><use href="#i-bell"/></svg>Értesítések</a></li>
+                <li><a href="/settings/security" class="{{if eq .Page "settings-security"}}active{{end}}"><svg class="ico"><use href="#i-lock"/></svg>Biztonság és hozzáférés</a></li>
+            </ul>
             <div class="sidebar-footer">
                 <span class="version">{{.Version}}</span>
                 {{if .AuthEnabled}}<a href="/logout" class="logout-link">Kijelentkezés ↗</a>{{end}}

controller/internal/web/templates/settings_notifications.html

@@ -0,0 +1,132 @@
+{{define "settings_notifications"}}
+{{template "layout_start" .}}
+
+<div class="page-header">
+    <h2>Beállítások — Értesítések</h2>
+</div>
+
+<!-- Section C: Notification Preferences -->
+<div class="settings-card">
+    <h3>Értesítések</h3>
+    {{if .HubEnabled}}
+        {{if .NotificationSuccess}}<div class="alert alert-info">{{.NotificationSuccess}}</div>{{end}}
+        {{if .NotificationError}}<div class="alert alert-error">{{.NotificationError}}</div>{{end}}
+        <form method="POST" action="/settings/notifications">
+            {{.CSRFField}}
+            <div class="form-group">
+                <label for="notification_email">E-mail cím</label>
+                <input type="email" id="notification_email" name="notification_email"
+                       value="{{with .NotificationPrefs}}{{.Email}}{{end}}"
+                       placeholder="pelda@email.hu" class="form-control">
+            </div>
+            <div class="form-group">
+                <label>Hibák és figyelmeztetések:</label>
+                <div class="checkbox-group">
+                    <label class="toggle">
+                        <input type="checkbox" name="event_backup_failed" {{with .NotificationPrefs}}{{range .EnabledEvents}}{{if eq . "backup_failed"}}checked{{end}}{{end}}{{end}}>
+                        <span class="toggle-label">Biztonsági mentés sikertelen</span>
+                    </label>
+                    <label class="toggle">
+                        <input type="checkbox" name="event_db_dump_failed" {{with .NotificationPrefs}}{{range .EnabledEvents}}{{if eq . "db_dump_failed"}}checked{{end}}{{end}}{{end}}>
+                        <span class="toggle-label">Adatbázis mentés sikertelen</span>
+                    </label>
+                    <label class="toggle">
+                        <input type="checkbox" name="event_backup_integrity_failed" {{with .NotificationPrefs}}{{range .EnabledEvents}}{{if eq . "backup_integrity_failed"}}checked{{end}}{{end}}{{end}}>
+                        <span class="toggle-label">Mentés sérülés észlelve</span>
+                    </label>
+                    <label class="toggle">
+                        <input type="checkbox" name="event_crossdrive_failed" {{with .NotificationPrefs}}{{range .EnabledEvents}}{{if eq . "crossdrive_failed"}}checked{{end}}{{end}}{{end}}>
+                        <span class="toggle-label">Másodlagos mentés sikertelen</span>
+                    </label>
+                    <label class="toggle">
+                        <input type="checkbox" name="event_disk_alerts" {{with .NotificationPrefs}}{{range .EnabledEvents}}{{if eq . "disk_warning"}}checked{{end}}{{end}}{{end}}>
+                        <span class="toggle-label">Lemez figyelmeztetés (90%+)</span>
+                    </label>
+                    <label class="toggle">
+                        <input type="checkbox" name="event_storage_disconnected" {{with .NotificationPrefs}}{{range .EnabledEvents}}{{if eq . "storage_disconnected"}}checked{{end}}{{end}}{{end}}>
+                        <span class="toggle-label">Meghajtó leválasztva</span>
+                    </label>
+                    <label class="toggle">
+                        <input type="checkbox" name="event_node_down" {{with .NotificationPrefs}}{{range .EnabledEvents}}{{if eq . "node_down"}}checked{{end}}{{end}}{{end}}>
+                        <span class="toggle-label">Szerver nem elérhető</span>
+                    </label>
+                    <label class="toggle">
+                        <input type="checkbox" name="event_health_critical" {{with .NotificationPrefs}}{{range .EnabledEvents}}{{if eq . "health_critical"}}checked{{end}}{{end}}{{end}}>
+                        <span class="toggle-label">Rendszer állapot kritikus</span>
+                    </label>
+                    <label class="toggle">
+                        <input type="checkbox" name="event_expected_missed" {{with .NotificationPrefs}}{{range .EnabledEvents}}{{if eq . "expected_backup_missed"}}checked{{end}}{{end}}{{end}}>
+                        <span class="toggle-label">Elvárt mentés elmaradt</span>
+                    </label>
+                </div>
+            </div>
+            <div class="form-group">
+                <label>Tájékoztató:</label>
+                <div class="checkbox-group">
+                    <label class="toggle">
+                        <input type="checkbox" name="event_storage_reconnected" {{with .NotificationPrefs}}{{range .EnabledEvents}}{{if eq . "storage_reconnected"}}checked{{end}}{{end}}{{end}}>
+                        <span class="toggle-label">Meghajtó újra csatlakoztatva</span>
+                    </label>
+                    <label class="toggle">
+                        <input type="checkbox" name="event_health_recovered" {{with .NotificationPrefs}}{{range .EnabledEvents}}{{if eq . "health_recovered"}}checked{{end}}{{end}}{{end}}>
+                        <span class="toggle-label">Rendszer állapot helyreállt</span>
+                    </label>
+                </div>
+            </div>
+            <div class="form-group">
+                <label for="cooldown_hours">Értesítési szünet</label>
+                <div class="form-inline">
+                    <input type="number" id="cooldown_hours" name="cooldown_hours" min="1" max="168"
+                           value="{{with .NotificationPrefs}}{{.CooldownHours}}{{end}}"
+                           class="form-control form-control-narrow">
+                    <span class="form-hint">óra (azonos probléma esetén ennyi ideig nem küld újat)</span>
+                </div>
+            </div>
+            <div class="form-actions">
+                <button type="submit" class="btn btn-primary">Mentés</button>
+                <button type="submit" formaction="/settings/notifications/test" class="btn btn-outline">Teszt email küldése</button>
+            </div>
+        </form>
+    {{else}}
+        <div class="alert alert-info">
+            Az értesítések a központi rendszeren keresztül működnek, ami jelenleg nincs bekapcsolva.
+        </div>
+    {{end}}
+</div>
+
+<!-- Section: App email (SMTP relay) -->
+{{if .AppEmailAvailable}}
+<div class="settings-card">
+    <h3>Alkalmazás-email</h3>
+    <p class="settings-card-desc">
+        Az alkalmazások a Felhom-on keresztül küldhetnek emailt (pl. jelszó-visszaállítás, meghívók),
+        külön email-szolgáltató beállítása nélkül. A feladó címe minden alkalmazásnál a saját
+        <em>&lt;alkalmazás&gt;@felhom.eu</em> címe lesz.
+    </p>
+    {{if .AppEmailSuccess}}<div class="alert alert-info">{{.AppEmailSuccess}}</div>{{end}}
+    {{if .AppEmailError}}<div class="alert alert-error">{{.AppEmailError}}</div>{{end}}
+    <form method="POST" action="/settings/app-email">
+        {{.CSRFField}}
+        <div class="form-group">
+            <label style="display:flex;align-items:center;gap:.5rem">
+                <input type="checkbox" name="app_email_enabled" value="on" {{if .AppEmailEnabled}}checked{{end}}>
+                Alkalmazás-email engedélyezése
+            </label>
+        </div>
+        <div class="form-group">
+            <label for="app_email_from_name">Feladó neve (opcionális)</label>
+            <input type="text" id="app_email_from_name" name="app_email_from_name"
+                   value="{{.AppEmailFromName}}" placeholder="pl. a háztartás neve" class="form-control">
+            <span class="form-hint">Ez jelenik meg a kimenő emailek feladójaként az alkalmazás neve mellett.</span>
+        </div>
+        <div class="form-actions">
+            <button type="submit" class="btn btn-primary">Mentés</button>
+        </div>
+    </form>
+    <p class="settings-card-desc" style="margin-top:.75rem">
+        Bekapcsolás után az egyes alkalmazásoknál is engedélyezni kell az email-küldést (az alkalmazás oldalán).
+    </p>
+</div>
+{{end}}
+{{template "layout_end" .}}
+{{end}}

controller/internal/web/templates/settings_security.html

@@ -0,0 +1,447 @@
+{{define "settings_security"}}
+{{template "layout_start" .}}
+
+<div class="page-header">
+    <h2>Beállítások — Biztonság és hozzáférés</h2>
+</div>
+
+<!-- Section B: Password Change -->
+<div class="settings-card">
+    <h3>Jelszó módosítás</h3>
+    {{if .AuthEnabled}}
+        {{if .PasswordError}}<div class="alert alert-error">{{.PasswordError}}</div>{{end}}
+        <form method="POST" action="/settings/password">
+            {{.CSRFField}}
+            <div class="form-group">
+                <label for="current_password">Jelenlegi jelszó</label>
+                <input type="password" id="current_password" name="current_password" required
+                       placeholder="Adja meg a jelenlegi jelszavát" class="form-control">
+            </div>
+            <div class="form-group">
+                <label for="new_password">Új jelszó</label>
+                <input type="password" id="new_password" name="new_password" required minlength="8"
+                       placeholder="Legalább 8 karakter" class="form-control">
+            </div>
+            <div class="form-group">
+                <label for="confirm_password">Új jelszó megerősítése</label>
+                <input type="password" id="confirm_password" name="confirm_password" required minlength="8"
+                       placeholder="Jelszó mégegyszer" class="form-control">
+            </div>
+            <button type="submit" class="btn btn-primary">Jelszó módosítása</button>
+        </form>
+    {{else}}
+        <div class="alert alert-info">
+            A jelszavas védelem nincs beállítva. Kérd az üzemeltetőt a beállításhoz.
+        </div>
+    {{end}}
+</div>
+
+<!-- Section: Geo-Restriction -->
+<div class="settings-card">
+    <h3>Földrajzi korlátozás</h3>
+    <p class="settings-card-desc">
+        Ország alapján korlátozható a webes alkalmazások elérése a Cloudflare WAF segítségével.
+        <br><span class="form-hint">A helyi hálózati hozzáférés mindig engedélyezett (nem halad át a Cloudflare-en).</span>
+    </p>
+
+    {{if not .CFConfigured}}
+    <div class="alert alert-info">
+        A Cloudflare API token nincs konfigurálva. Kérd az üzemeltetőt a beállításhoz.<br>
+        <small>A tokennek <strong>Zone WAF:Edit</strong> jogosultsággal kell rendelkeznie.</small>
+    </div>
+    {{else}}
+    <div id="geo-status-msg"></div>
+
+    <label class="toggle" style="margin-bottom:1rem">
+        <input type="checkbox" id="geo-enabled" {{if .GeoEnabled}}checked{{end}}
+               onchange="toggleGeo(this.checked)">
+        <span class="toggle-label">Geo-korlátozás aktív</span>
+    </label>
+
+    <div id="geo-details" {{if not .GeoEnabled}}style="display:none"{{end}}>
+        <!-- Global allowed countries -->
+        <div class="form-group">
+            <label>Engedélyezett országok (globális)</label>
+            <div class="geo-country-selector" id="geo-countries">
+                <input type="text" id="geo-search" class="form-control"
+                       placeholder="Ország keresése..."
+                       autocomplete="off"
+                       oninput="filterCountries(this.value)"
+                       onfocus="showCountryList()"
+                       onblur="setTimeout(function(){hideCountryList()},200)">
+                <div class="geo-country-list" id="geo-country-list"></div>
+            </div>
+            <div class="geo-selected-tags" id="geo-selected-tags"></div>
+            <span class="form-hint">Csak a kiválasztott országokból érhető el a rendszer.</span>
+        </div>
+
+        <!-- Per-app overrides -->
+        <div class="form-group" style="margin-top:1.5rem">
+            <label>Alkalmazás-specifikus felülírások</label>
+            <div id="geo-app-overrides"></div>
+            {{if .DeployedApps}}
+            <div style="margin-top:.5rem;display:flex;align-items:center;gap:.5rem">
+                <select id="geo-add-app-select" class="form-control" style="max-width:250px">
+                    <option value="">— Alkalmazás kiválasztása —</option>
+                    {{range .DeployedApps}}
+                    <option value="{{.Name}}">{{.Display}}</option>
+                    {{end}}
+                </select>
+                <button class="btn btn-sm btn-outline" onclick="addAppOverride()">+ Hozzáadás</button>
+            </div>
+            {{end}}
+        </div>
+
+        <!-- Sync status & save -->
+        <div class="form-group" style="margin-top:1.5rem">
+            <div style="display:flex;align-items:center;gap:1rem;flex-wrap:wrap">
+                <button class="btn btn-primary" id="btn-geo-save" onclick="saveGeoSettings()">
+                    Mentés és szinkronizálás
+                </button>
+                <button class="btn btn-sm btn-outline" onclick="triggerGeoSync()">Kézi szinkronizálás</button>
+                <span id="geo-sync-status" class="form-hint">
+                    {{if .GeoLastSync}}Utolsó szinkronizálás: {{.GeoLastSync}}{{end}}
+                    {{if .GeoLastError}} <span class="state-text-crit">{{.GeoLastError}}</span>{{end}}
+                </span>
+            </div>
+        </div>
+    </div>
+    {{end}}
+</div>
+
+<div id="dialog-root"></div>
+<script>
+// Light overlay dialog (D1) — replaces the native blocking browser dialogs (same texts).
+function escText(s){var d=document.createElement('div');d.textContent=String(s==null?'':s);return d.innerHTML;}
+function closeDialog(){ var r=document.getElementById('dialog-root'); if(r) r.innerHTML=''; }
+function openDialog(opts){
+    var root=document.getElementById('dialog-root');
+    if(!root) return;
+    root.innerHTML='<div class="confirm-overlay" onclick="if(event.target===this)document.getElementById(\'dialog-cancel\').click()"><div class="confirm-box">'
+        +'<h3>'+escText(opts.title||'Megerősítés')+'</h3>'
+        +'<p style="white-space:pre-line">'+escText(opts.message||'')+'</p>'
+        +'<div class="form-actions"><button id="dialog-go" class="btn btn-primary">'+escText(opts.confirmLabel||'Megerősítés')+'</button>'
+        +'<button type="button" class="btn btn-outline" id="dialog-cancel">Mégsem</button></div>'
+        +'</div></div>';
+    document.getElementById('dialog-go').onclick=function(){ closeDialog(); if(opts.onConfirm) opts.onConfirm(); };
+    document.getElementById('dialog-cancel').onclick=function(){ closeDialog(); if(opts.onCancel) opts.onCancel(); };
+}
+
+(function(){
+    // Geo-restriction UI state
+    var allCountries = [];
+    var selectedCountries = {{json .GeoAllowedCountries}};
+    var appOverrides = {{json .GeoAppOverrides}};
+
+    // Load countries list on first use
+    function ensureCountries(cb) {
+        if (allCountries.length > 0) { cb(); return; }
+        fetch('/api/geo/countries', {headers: csrfHeaders()})
+            .then(function(r){return r.json()})
+            .then(function(d){
+                if (d.ok) allCountries = d.data;
+                cb();
+            })
+            .catch(function(){ cb(); });
+    }
+
+    window.toggleGeo = function(enabled) {
+        document.getElementById('geo-details').style.display = enabled ? '' : 'none';
+        if (enabled) ensureCountries(renderTags);
+    };
+
+    window.showCountryList = function() {
+        ensureCountries(function(){ filterCountries(document.getElementById('geo-search').value); });
+    };
+
+    window.hideCountryList = function() {
+        document.getElementById('geo-country-list').style.display = 'none';
+    };
+
+    window.filterCountries = function(query) {
+        var list = document.getElementById('geo-country-list');
+        var q = query.toLowerCase();
+        var html = '';
+        var count = 0;
+        for (var i = 0; i < allCountries.length && count < 15; i++) {
+            var c = allCountries[i];
+            if (selectedCountries.indexOf(c.code) >= 0) continue;
+            if (q && c.name.toLowerCase().indexOf(q) < 0 && c.code.toLowerCase().indexOf(q) < 0) continue;
+            html += '<div class="geo-country-option" onmousedown="addCountry(\'' + c.code + '\',\'' + escHtml(c.name) + '\')">'
+                + escHtml(c.name) + ' <small>(' + c.code + ')</small></div>';
+            count++;
+        }
+        list.innerHTML = html || '<div class="geo-country-option" style="opacity:.5">Nincs találat</div>';
+        // Reveal with 'block', NOT '' — the .geo-country-list CSS default is display:none,
+        // and clearing the inline style ('') would fall back to that and keep the (populated)
+        // list hidden. This was the country-autocomplete "no list" bug.
+        list.style.display = count > 0 || q ? 'block' : 'none';
+    };
+
+    window.addCountry = function(code, name) {
+        if (selectedCountries.indexOf(code) >= 0) return;
+        selectedCountries.push(code);
+        renderTags();
+        document.getElementById('geo-search').value = '';
+        hideCountryList();
+    };
+
+    window.removeCountry = function(code) {
+        if (code === 'HU') {
+            openDialog({title:'Figyelem', confirmLabel:'Eltávolítás',
+                message:'Figyelem: Magyarország eltávolítása azt jelenti, hogy magyar IP-ről sem lesz elérhető a rendszer távolról. Biztosan folytatja?',
+                onConfirm:function(){ doRemoveCountry(code); }});
+            return;
+        }
+        doRemoveCountry(code);
+    };
+    function doRemoveCountry(code) {
+        selectedCountries = selectedCountries.filter(function(c){return c !== code});
+        renderTags();
+    }
+
+    function renderTags() {
+        var el = document.getElementById('geo-selected-tags');
+        var html = '';
+        for (var i = 0; i < selectedCountries.length; i++) {
+            var code = selectedCountries[i];
+            var name = countryName(code);
+            var isHU = code === 'HU' ? ' geo-tag-hu' : '';
+            html += '<span class="geo-tag' + isHU + '">'
+                + escHtml(name) + ' (' + code + ') '
+                + '<span class="geo-tag-remove" onclick="removeCountry(\'' + code + '\')">&times;</span>'
+                + '</span>';
+        }
+        el.innerHTML = html;
+        renderAppOverrides();
+    }
+
+    function countryName(code) {
+        for (var i = 0; i < allCountries.length; i++) {
+            if (allCountries[i].code === code) return allCountries[i].name;
+        }
+        return code;
+    }
+
+    // --- Per-app overrides ---
+    window.addAppOverride = function() {
+        var sel = document.getElementById('geo-add-app-select');
+        var appName = sel.value;
+        if (!appName) return;
+        if (!appOverrides) appOverrides = {};
+        if (appOverrides[appName]) { sel.value = ''; return; }
+        // Default: same countries as global
+        appOverrides[appName] = {allowed_countries: selectedCountries.slice()};
+        sel.value = '';
+        renderAppOverrides();
+    };
+
+    window.removeAppOverride = function(appName) {
+        delete appOverrides[appName];
+        renderAppOverrides();
+    };
+
+    window.toggleAppCountry = function(appName, code, el) {
+        var ov = appOverrides[appName];
+        if (!ov) return;
+        var idx = ov.allowed_countries.indexOf(code);
+        if (idx >= 0) {
+            if (code === 'HU') {
+                openDialog({title:'Figyelem', confirmLabel:'Eltávolítás',
+                    message:'Magyarország eltávolítása nem ajánlott. Folytatja?',
+                    onConfirm:function(){ ov.allowed_countries.splice(ov.allowed_countries.indexOf(code), 1); },
+                    onCancel:function(){ el.checked = true; }});
+                return;
+            }
+            ov.allowed_countries.splice(idx, 1);
+        } else {
+            ov.allowed_countries.push(code);
+        }
+    };
+
+    function renderAppOverrides() {
+        var el = document.getElementById('geo-app-overrides');
+        if (!appOverrides || Object.keys(appOverrides).length === 0) {
+            el.innerHTML = '<p class="form-hint">Nincs alkalmazás-specifikus beállítás. Minden alkalmazás a globális beállítást követi.</p>';
+            return;
+        }
+        var html = '';
+        for (var appName in appOverrides) {
+            var ov = appOverrides[appName];
+            var displayName = appName;
+            // Try to find display name from select
+            var opts = document.getElementById('geo-add-app-select');
+            if (opts) {
+                for (var j = 0; j < opts.options.length; j++) {
+                    if (opts.options[j].value === appName) { displayName = opts.options[j].text; break; }
+                }
+            }
+            html += '<div class="geo-app-override-row">';
+            html += '<strong>' + escHtml(displayName) + '</strong>';
+            html += '<div class="geo-selected-tags" style="flex:1;margin:0 .5rem">';
+            for (var i = 0; i < ov.allowed_countries.length; i++) {
+                var code = ov.allowed_countries[i];
+                html += '<span class="geo-tag geo-tag-sm">' + code + '</span>';
+            }
+            html += '</div>';
+            html += '<button class="btn btn-sm btn-outline" onclick="editAppOverride(\'' + appName + '\')">Szerkesztés</button>';
+            html += '<button class="btn btn-sm btn-danger-outline" onclick="removeAppOverride(\'' + appName + '\')">Törlés</button>';
+            html += '</div>';
+        }
+        el.innerHTML = html;
+    }
+
+    window.editAppOverride = function(appName) {
+        var ov = appOverrides[appName];
+        if (!ov) return;
+        ensureCountries(function(){
+            var checked = {};
+            for (var i = 0; i < ov.allowed_countries.length; i++) checked[ov.allowed_countries[i]] = true;
+            var html = '<div class="geo-edit-overlay" id="geo-edit-' + appName + '">';
+            html += '<h4>Engedélyezett országok: ' + escHtml(appName) + '</h4>';
+            html += '<div class="geo-edit-grid">';
+            for (var i = 0; i < allCountries.length; i++) {
+                var c = allCountries[i];
+                html += '<label class="geo-edit-item"><input type="checkbox" value="' + c.code + '"'
+                    + (checked[c.code] ? ' checked' : '') + ' onchange="toggleAppCountry(\'' + appName + '\',\'' + c.code + '\',this)">'
+                    + ' ' + escHtml(c.name) + ' (' + c.code + ')</label>';
+            }
+            html += '</div>';
+            html += '<button class="btn btn-sm btn-primary" style="margin-top:.5rem" onclick="closeAppEdit(\'' + appName + '\')">Kész</button>';
+            html += '</div>';
+            document.getElementById('geo-app-overrides').innerHTML += html;
+        });
+    };
+
+    window.closeAppEdit = function(appName) {
+        var el = document.getElementById('geo-edit-' + appName);
+        if (el) el.remove();
+        renderAppOverrides();
+    };
+
+    // --- Save & Sync ---
+    window.saveGeoSettings = function() {
+        var btn = document.getElementById('btn-geo-save');
+        var status = document.getElementById('geo-status-msg');
+        btn.disabled = true;
+        btn.textContent = 'Mentés...';
+
+        var payload = {
+            enabled: document.getElementById('geo-enabled').checked,
+            allowed_countries: selectedCountries
+        };
+
+        fetch('/api/geo/settings', {
+            method: 'POST',
+            headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
+            body: JSON.stringify(payload)
+        })
+        .then(function(r){return r.json()})
+        .then(function(d){
+            if (d.ok) {
+                status.innerHTML = '<div class="alert alert-info">' + (d.message || 'Mentve') + '</div>';
+                // Save per-app overrides
+                if (appOverrides && Object.keys(appOverrides).length > 0) {
+                    saveAllAppOverrides();
+                }
+            } else {
+                status.innerHTML = '<div class="alert alert-error">' + (d.error || 'Hiba') + '</div>';
+            }
+        })
+        .catch(function(err){
+            status.innerHTML = '<div class="alert alert-error">Hálózati hiba</div>';
+        })
+        .finally(function(){
+            btn.disabled = false;
+            btn.textContent = 'Mentés és szinkronizálás';
+            setTimeout(function(){ status.innerHTML = ''; }, 8000);
+        });
+    };
+
+    function saveAllAppOverrides() {
+        for (var appName in appOverrides) {
+            (function(name, ov){
+                fetch('/api/stacks/' + name + '/geo/override', {
+                    method: 'POST',
+                    headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
+                    body: JSON.stringify({allowed_countries: ov.allowed_countries})
+                });
+            })(appName, appOverrides[appName]);
+        }
+    }
+
+    window.triggerGeoSync = function() {
+        fetch('/api/geo/sync', {method:'POST', headers: csrfHeaders()})
+            .then(function(r){return r.json()})
+            .then(function(d){
+                var status = document.getElementById('geo-sync-status');
+                status.textContent = d.ok ? 'Szinkronizálás elindítva...' : (d.error || 'Hiba');
+                setTimeout(function(){
+                    fetch('/api/geo/status', {headers: csrfHeaders()})
+                        .then(function(r){return r.json()})
+                        .then(function(d){
+                            if (d.ok && d.data) {
+                                var sync = d.data.last_sync || '';
+                                var err = d.data.last_sync_error || '';
+                                status.innerHTML = sync ? ('Utolsó: ' + sync.substring(0,19).replace('T',' ')) : '';
+                                if (err) status.innerHTML += ' <span class="state-text-crit">' + escHtml(err) + '</span>';
+                            }
+                        });
+                }, 5000);
+            });
+    };
+
+    function escHtml(s) {
+        var d = document.createElement('div');
+        d.textContent = s;
+        return d.innerHTML;
+    }
+
+    // Initialize on load
+    if (document.getElementById('geo-enabled') && document.getElementById('geo-enabled').checked) {
+        ensureCountries(renderTags);
+    }
+})();
+</script>
+
+<!-- Section: Recovery Info -->
+{{if .RetrievalPassword}}
+<div class="settings-card">
+    <h3>Vészhelyzeti információk</h3>
+    <p class="settings-card-desc">
+        Ezeket az adatokat mentse el biztos helyre. Újratelepítés esetén szükség lesz rájuk a rendszer visszaállításához.
+    </p>
+    <div class="settings-grid">
+        <div class="settings-row">
+            <span class="settings-label">Ügyfél azonosító</span>
+            <span class="settings-value mono">{{.CustomerID}}</span>
+        </div>
+        <div class="settings-row">
+            <span class="settings-label">Hub URL</span>
+            <span class="settings-value mono">{{.HubURL}}</span>
+        </div>
+        <div class="settings-row">
+            <span class="settings-label">Visszaállítási jelszó</span>
+            <span class="settings-value">
+                <span id="retrieval-pw-hidden">••••••••••••••••
+                    <button type="button" class="btn btn-xs btn-outline" onclick="document.getElementById('retrieval-pw-hidden').style.display='none';document.getElementById('retrieval-pw-visible').style.display='inline';">Megjelenít</button>
+                </span>
+                <span id="retrieval-pw-visible" style="display:none">
+                    <code class="mono">{{.RetrievalPassword}}</code>
+                    <button type="button" class="btn btn-xs btn-outline" onclick="document.getElementById('retrieval-pw-visible').style.display='none';document.getElementById('retrieval-pw-hidden').style.display='inline';">Elrejt</button>
+                </span>
+            </span>
+        </div>
+        <div class="settings-row">
+            <span class="settings-label">Támogatás</span>
+            <span class="settings-value">
+                <a href="mailto:{{.SupportEmail}}" style="color: var(--blue);">{{.SupportEmail}}</a>
+                &nbsp;|&nbsp;
+                <a href="{{.SupportURL}}" target="_blank" style="color: var(--blue);">felhom.eu/kapcsolat</a>
+            </span>
+        </div>
+    </div>
+</div>
+{{end}}
+{{template "layout_end" .}}
+{{end}}

controller/internal/web/templates/settings_system.html

@@ -0,0 +1,303 @@
+{{define "settings_system"}}
+{{template "layout_start" .}}
+
+<div class="page-header">
+    <h2>Beállítások — Rendszer</h2>
+</div>
+
+<!-- Section A: System Configuration (read-only) -->
+<div class="settings-card">
+    <h3>Rendszer konfiguráció</h3>
+    <p class="settings-card-desc">Az üzemeltető által beállított értékek. Módosításhoz kérd az üzemeltetőt.</p>
+    <div class="settings-grid">
+        <div class="settings-row">
+            <span class="settings-label">Ügyfél azonosító</span>
+            <span class="settings-value mono">{{.CustomerID}}</span>
+        </div>
+        <div class="settings-row">
+            <span class="settings-label">Ügyfél neve</span>
+            <span class="settings-value">{{.CustomerName}}</span>
+        </div>
+        <div class="settings-row">
+            <span class="settings-label">Domain</span>
+            <span class="settings-value mono">{{.CustomerDomain}}</span>
+        </div>
+        {{if .GitRepoURL}}
+        <div class="settings-row">
+            <span class="settings-label">Alkalmazás sablon forrás</span>
+            <span class="settings-value mono settings-value-truncate">{{.GitRepoURL}}</span>
+        </div>
+        {{end}}
+        <div class="settings-row">
+            <span class="settings-label">Sablon szinkronizálás</span>
+            <span class="settings-value mono">{{.GitSyncInterval}}</span>
+        </div>
+        <div class="settings-row">
+            <span class="settings-label">Biztonsági mentés</span>
+            <span class="settings-value">{{if .BackupEnabled}}<span class="state-text-run"><svg class="ico ico-sm"><use href="#i-check"/></svg> Aktív</span>{{else}}<span class="state-text-neutral">Inaktív</span>{{end}}</span>
+        </div>
+        {{if .BackupEnabled}}
+        <div class="settings-row">
+            <span class="settings-label">Mentés ütemezés</span>
+            <span class="settings-value mono">{{.DBDumpSchedule}} / {{.ResticSchedule}}</span>
+        </div>
+        {{end}}
+        <div class="settings-row">
+            <span class="settings-label">Monitoring</span>
+            <span class="settings-value">{{if .MonitoringEnabled}}<span class="state-text-run"><svg class="ico ico-sm"><use href="#i-check"/></svg> Aktív</span>{{else}}<span class="state-text-neutral">Inaktív</span>{{end}}</span>
+        </div>
+        {{if .MonitoringEnabled}}
+        <div class="settings-row">
+            <span class="settings-label">Healthchecks URL</span>
+            <span class="settings-value mono settings-value-truncate">{{if .HealthchecksBase}}{{.HealthchecksBase}}{{else}}–{{end}}</span>
+        </div>
+        {{end}}
+        <div class="settings-row">
+            <span class="settings-label">Hub jelentés</span>
+            <span class="settings-value">{{if .HubEnabled}}<span class="state-text-run"><svg class="ico ico-sm"><use href="#i-check"/></svg> Aktív</span>{{else}}–{{end}}</span>
+        </div>
+    </div>
+</div>
+
+<!-- Section: Version & Update -->
+<div class="settings-card">
+    <h3>Verzió és frissítés</h3>
+    <div class="settings-grid">
+        <div class="settings-row">
+            <span class="settings-label">Jelenlegi verzió</span>
+            <span class="settings-value mono">{{.Version}}</span>
+        </div>
+        {{if .SelfUpdateEnabled}}
+        {{if .LatestVersion}}
+        <div class="settings-row">
+            <span class="settings-label">Legújabb verzió</span>
+            <span class="settings-value mono">
+                {{.LatestVersion}}
+                {{if .UpdateAvailable}}
+                <span class="state-text-run" style="margin-left:0.5em;">● Frissítés elérhető</span>
+                {{else}}
+                <span style="margin-left:0.5em; color:var(--text-3);">— naprakész</span>
+                {{end}}
+            </span>
+        </div>
+        {{end}}
+        {{if .LastCheckTime}}
+        <div class="settings-row">
+            <span class="settings-label">Utolsó ellenőrzés</span>
+            <span class="settings-value mono">{{.LastCheckTime}}</span>
+        </div>
+        {{end}}
+        {{if .LastCheckError}}
+        <div class="settings-row">
+            <span class="settings-label">Hiba</span>
+            <span class="settings-value state-text-crit">{{.LastCheckError}}</span>
+        </div>
+        {{end}}
+        <div class="settings-row">
+            <span class="settings-label">Automatikus frissítés</span>
+            <span class="settings-value">
+                {{if .AutoUpdateEnabled}}<span class="state-text-run"><svg class="ico ico-sm"><use href="#i-check"/></svg> Aktív</span> <span class="mono">({{.AutoUpdateTime}})</span>{{else}}–{{end}}
+            </span>
+        </div>
+        {{if .ControllerFloor}}
+        <div class="settings-row">
+            <span class="settings-label">Minimális verzió (üzemeltető)</span>
+            <span class="settings-value mono">
+                {{.ControllerFloor}}
+                <span style="margin-left:0.5em; color:#888;">— a rendszer automatikusan erre a verzióra frissít, ha régebbi</span>
+            </span>
+        </div>
+        {{end}}
+        {{if .UpdateRunning}}
+        <div class="settings-row">
+            <span class="settings-label">Állapot</span>
+            <span class="settings-value state-text-progress" id="auto-update-status"><svg class="ico ico-sm ico-spin"><use href="#i-rotate-cw"/></svg> Frissítés folyamatban — a vezérlő hamarosan újraindul…</span>
+        </div>
+        {{end}}
+        {{with .LastUpdateState}}
+        <div class="settings-row">
+            <span class="settings-label">Utolsó frissítés</span>
+            <span class="settings-value">
+                {{if eq .Status "success"}}<span class="state-text-run"><svg class="ico ico-sm"><use href="#i-check"/></svg> Sikeres</span> ({{.PreviousVersion}} → {{.TargetVersion}})
+                {{else if eq .Status "failed"}}<span class="state-text-crit"><svg class="ico ico-sm"><use href="#i-x"/></svg> Sikertelen</span> — {{.Error}}
+                {{else if eq .Status "pending"}}<span class="state-text-progress"><svg class="ico ico-sm ico-spin"><use href="#i-rotate-cw"/></svg> Folyamatban</span>
+                {{end}}
+            </span>
+        </div>
+        {{end}}
+        <div class="settings-row" style="padding-top: 0.5em;">
+            <span class="settings-label"></span>
+            <span class="settings-value">
+                <button class="btn btn-secondary btn-sm" id="btn-check-update" onclick="checkUpdate()">Frissítés keresése</button>
+                {{if .UpdateAvailable}}
+                <button class="btn btn-primary btn-sm" id="btn-trigger-update" onclick="triggerUpdate()" style="margin-left:0.5em;">Frissítés telepítése</button>
+                {{end}}
+                <span id="update-status-msg" style="margin-left:0.5em; display:none;"></span>
+            </span>
+        </div>
+        {{end}}
+    </div>
+</div>
+
+<div id="dialog-root"></div>
+<script>
+// Light overlay dialog (D1) — replaces the native blocking browser dialogs (same texts).
+function escText(s){var d=document.createElement('div');d.textContent=String(s==null?'':s);return d.innerHTML;}
+function closeDialog(){ var r=document.getElementById('dialog-root'); if(r) r.innerHTML=''; }
+function openDialog(opts){
+    var root=document.getElementById('dialog-root');
+    if(!root) return;
+    root.innerHTML='<div class="confirm-overlay" onclick="if(event.target===this)document.getElementById(\'dialog-cancel\').click()"><div class="confirm-box">'
+        +'<h3>'+escText(opts.title||'Megerősítés')+'</h3>'
+        +'<p style="white-space:pre-line">'+escText(opts.message||'')+'</p>'
+        +'<div class="form-actions"><button id="dialog-go" class="btn btn-primary">'+escText(opts.confirmLabel||'Megerősítés')+'</button>'
+        +'<button type="button" class="btn btn-outline" id="dialog-cancel">Mégsem</button></div>'
+        +'</div></div>';
+    document.getElementById('dialog-go').onclick=function(){ closeDialog(); if(opts.onConfirm) opts.onConfirm(); };
+    document.getElementById('dialog-cancel').onclick=function(){ closeDialog(); if(opts.onCancel) opts.onCancel(); };
+}
+
+function checkUpdate() {
+    var btn = document.getElementById('btn-check-update');
+    var msg = document.getElementById('update-status-msg');
+    btn.disabled = true;
+    btn.textContent = 'Ellenőrzés...';
+    msg.style.display = 'none';
+    fetch('/api/selfupdate/check', {method:'POST', headers: csrfHeaders()})
+        .then(function(r) { return r.json(); })
+        .then(function(data) {
+            if (data.ok) {
+                location.reload();
+            } else {
+                msg.textContent = data.error || 'Hiba történt';
+                msg.style.display = 'inline';
+                btn.disabled = false;
+                btn.textContent = 'Frissítés keresése';
+            }
+        })
+        .catch(function() {
+            msg.textContent = 'Kapcsolódási hiba';
+            msg.style.display = 'inline';
+            btn.disabled = false;
+            btn.textContent = 'Frissítés keresése';
+        });
+}
+
+function triggerUpdate() {
+    openDialog({title:'Vezérlő frissítése', confirmLabel:'Frissítés',
+        message:'Biztosan frissíti a controllert?\n\nA folyamat alatt a vezérlőpult rövid időre elérhetetlenné válik.',
+        onConfirm:doTriggerUpdate});
+}
+function doTriggerUpdate() {
+    var btn = document.getElementById('btn-trigger-update');
+    var checkBtn = document.getElementById('btn-check-update');
+    var msg = document.getElementById('update-status-msg');
+    btn.disabled = true;
+    btn.textContent = 'Frissítés...';
+    if (checkBtn) checkBtn.disabled = true;
+    msg.textContent = 'Frissítés folyamatban...';
+    msg.style.display = 'inline';
+    fetch('/api/selfupdate/update', {method:'POST', headers: csrfHeaders()})
+        .then(function(r) { return r.json(); })
+        .then(function(data) {
+            if (data.ok) {
+                msg.textContent = 'Újraindulás...';
+                pollUntilBack();
+            } else {
+                msg.textContent = data.error || 'Hiba történt';
+                btn.disabled = false;
+                btn.textContent = 'Frissítés telepítése';
+                if (checkBtn) checkBtn.disabled = false;
+            }
+        })
+        .catch(function() {
+            msg.textContent = 'Kapcsolódási hiba';
+            pollUntilBack();
+        });
+}
+
+function pollUntilBack() {
+    var iv = setInterval(function() {
+        fetch('/api/health')
+            .then(function(r) {
+                if (r.ok) {
+                    clearInterval(iv);
+                    location.reload();
+                }
+            })
+            .catch(function() {});
+    }, 3000);
+}
+
+// If an update is already in flight when the page loads (e.g. a floor-driven AUTO-update kicked off by
+// the hub, not a button click), surface the same restart-poll panel so the page recovers itself.
+{{if .UpdateRunning}}
+pollUntilBack();
+{{end}}
+</script>
+
+<!-- Section: Controller restart (self-serve) — always available (not gated on RetrievalPassword) -->
+<div class="settings-card">
+    <h3>Vezérlő újraindítása</h3>
+    <p class="settings-card-desc">
+        Ha a vezérlő hibásan működik, itt biztonságosan újraindíthatja — nem kell az egész szervert újraindítani.
+        Az alkalmazásai futnak tovább; csak a vezérlő indul újra (néhány másodperc).
+    </p>
+    <div id="restart-status"></div>
+    <button type="button" class="btn btn-outline" id="btn-restart-controller" onclick="restartController()">Vezérlő újraindítása</button>
+</div>
+
+<!-- Section: Full server (guest) restart — a deliberate maintenance affordance, sibling to the controller restart -->
+<div class="settings-card">
+    <h3>Kiszolgáló újraindítása</h3>
+    <p class="settings-card-desc">
+        Az egész kiszolgáló (szerver) újraindítása. Minden alkalmazás rövid időre leáll, és a vezérlőpult kb. 30 másodpercig nem elérhető. Akkor használja, ha a teljes rendszer újraindítására van szükség — egyébként a fenti „Vezérlő újraindítása” elegendő.
+    </p>
+    <div id="server-restart-status"></div>
+    <button type="button" class="btn btn-outline" id="btn-restart-server" onclick="restartServer()">Kiszolgáló újraindítása</button>
+</div>
+
+<script>
+function restartController() {
+    openDialog({title:'Vezérlő újraindítása', confirmLabel:'Újraindítás',
+        message:'Biztosan újraindítja a vezérlőt? A művelet néhány másodpercig tart, és a felület rövid időre elérhetetlen lesz.',
+        onConfirm:doRestartController});
+}
+function doRestartController() {
+    var btn = document.getElementById('btn-restart-controller');
+    var status = document.getElementById('restart-status');
+    btn.disabled = true;
+    status.innerHTML = '<div class="alert alert-info">Újraindítás folyamatban… újracsatlakozás…</div>';
+    fetch('/api/selfrestart', { method: 'POST', headers: csrfHeaders() })
+        .then(function(){ pollRestart(0); })
+        .catch(function(){ pollRestart(0); }); // connection may drop as the process exits — poll regardless
+}
+function restartServer() {
+    openDialog({title:'Kiszolgáló újraindítása', confirmLabel:'Újraindítás',
+        message:'Biztosan újraindítja a kiszolgálót? Az alkalmazások és a vezérlőpult kb. 30 másodpercre elérhetetlenné válnak.',
+        onConfirm:doRestartServer});
+}
+function doRestartServer() {
+    var btn = document.getElementById('btn-restart-server');
+    var status = document.getElementById('server-restart-status');
+    if (btn) btn.disabled = true;
+    if (status) status.innerHTML = '<div class="alert alert-info">Újraindítás folyamatban… a vezérlőpult néhány másodperc múlva újratölt.</div>';
+    fetch('/api/server/reboot', { method: 'POST', headers: csrfHeaders() })
+        .then(function(){ pollRestart(0); })
+        .catch(function(){ pollRestart(0); });   // the guest reboot drops the connection — poll regardless
+}
+function pollRestart(attempt) {
+    if (attempt > 60) { // ~2 min cap — never leave the user on a dead page silently
+        document.getElementById('restart-status').innerHTML =
+            '<div class="alert alert-error">Az újraindítás a vártnál tovább tart. Töltse újra az oldalt kézzel.</div>';
+        return;
+    }
+    setTimeout(function(){
+        fetch('/', { method: 'GET', cache: 'no-store' })
+            .then(function(r){ if (r.ok) { window.location.reload(); } else { pollRestart(attempt + 1); } })
+            .catch(function(){ pollRestart(attempt + 1); });
+    }, 2000);
+}
+</script>
+{{template "layout_end" .}}
+{{end}}

controller/internal/web/templates/storage.html

@@ -0,0 +1,729 @@
+{{define "storage"}}
+{{template "layout_start" .}}
+
+<div class="page-header">
+    <h2>Tárhely</h2>
+</div>
+
+<!-- Section: Storage Paths -->
+<div class="settings-card">
+    <h3>Adattárolók</h3>
+    <p class="settings-card-desc">Külső meghajtók kezelése alkalmazásadatok tárolásához.</p>
+
+    {{if .StorageError}}<div class="alert alert-error">{{.StorageError}}</div>{{end}}
+    {{if .StorageSuccess}}<div class="alert alert-info">{{.StorageSuccess}}</div>{{end}}
+
+    {{if .StoragePaths}}
+    <div class="storage-paths-list">
+        {{range .StoragePaths}}
+        <div class="storage-path-item{{if .Disconnected}} storage-disconnected{{else if .Decommissioned}} storage-decommissioned{{end}}">
+            <div class="storage-path-header">
+                <div class="storage-path-info">
+                    <div class="storage-path-label-wrap" id="label-wrap-{{.Path}}">
+                        <span class="storage-path-label" id="label-display-{{.Path}}">{{.Label}}</span>
+                        {{if not (or .Disconnected .Decommissioned)}}<button class="btn btn-xs btn-ghost" onclick="editStorageLabel('{{.Path}}', '{{.Label}}')" title="Átnevezés"><svg class="ico ico-sm"><use href="#i-pencil"/></svg></button>{{end}}
+                    </div>
+                    <span class="storage-path-path mono">{{.Path}}</span>
+                </div>
+                <div class="storage-path-badges">
+                    {{if .Disconnected}}
+                    <span class="badge badge-error">Leválasztva</span>
+                    {{else if .Decommissioned}}
+                    <span class="tag tag-off"><span class="dot"></span>Kiváltva</span>
+                    {{else}}
+                    {{if .IsDefault}}<span class="tag">Alapértelmezett</span>{{end}}
+                    {{if .Schedulable}}<span class="tag tag-run"><span class="dot"></span>Aktív</span>{{else}}<span class="tag tag-off"><span class="dot"></span>Inaktív</span>{{end}}
+                    {{if .IsUSB}}<span class="badge" style="background:rgba(255,165,0,0.15);color:var(--warn)">USB</span>{{end}}
+                    {{if not .IsMounted}}<span class="badge badge-warn">Rendszermeghajtón</span>{{end}}
+                    {{end}}
+                </div>
+            </div>
+            {{if .Disconnected}}
+            <div class="storage-path-details">
+                <div class="storage-disconnected-info">
+                    {{if .DisconnectedAt}}<span class="form-hint">Leválasztva: {{.DisconnectedAt}}</span>{{end}}
+                    {{if .StoppedApps}}
+                    <span class="form-hint">Leállított alkalmazások: {{range $i, $name := .StoppedApps}}{{if $i}}, {{end}}{{$name}}{{end}}</span>
+                    {{end}}
+                </div>
+            </div>
+            <div class="storage-path-actions" id="storage-actions-{{.Path}}">
+                <button class="btn btn-xs btn-primary" onclick="storageReconnect('{{.Path}}')">Csatlakoztatás</button>
+            </div>
+            {{else if .Decommissioned}}
+            <div class="storage-path-details">
+                <div class="storage-disconnected-info">
+                    <span class="form-hint">Adatok átköltöztetve ide: <strong>{{.MigratedToLabel}}</strong> ({{.MigratedTo}})</span>
+                    {{if .DecommissionedAt}}<span class="form-hint">Időpont: {{.DecommissionedAt}}</span>{{end}}
+                </div>
+            </div>
+            <div class="storage-path-actions">
+                <button class="btn btn-xs btn-primary" onclick="storageReEnroll('{{.Path}}','{{.Label}}')">Visszacsatlakoztatás</button>
+                <form method="POST" action="/settings/storage/remove" style="display:inline"
+                      onsubmit="return storageRemoveDialog(event, this, 'Biztosan eltávolítja a(z) {{.Label}} ({{.Path}}) meghajtót a rendszerből?\n\nA meghajtó adatai NEM törlődnek.')">
+                    {{$.CSRFField}}
+                    <input type="hidden" name="storage_path" value="{{.Path}}">
+                    <button type="submit" class="btn btn-xs btn-outline">Eltávolítás a rendszerből</button>
+                </form>
+            </div>
+            {{else}}
+            <div class="storage-path-details">
+                {{if .DiskInfo}}
+                <div class="storage-path-disk">
+                    <div class="system-info-header">
+                        <span class="system-info-value">{{.DiskInfo.UsedHuman}} / {{.DiskInfo.TotalHuman}}</span>
+                    </div>
+                    <div class="meter {{if ge .DiskInfo.UsedPercent 90.0}}crit{{else if ge .DiskInfo.UsedPercent 70.0}}warn{{else}}nominal{{end}}">
+                        <div class="meter-track">
+                            <div class="meter-fill" style="width:{{printf "%.0f" .DiskInfo.UsedPercent}}%"></div>
+                        </div>
+                    </div>
+                </div>
+                {{end}}
+                {{if .FSInfo}}
+                <div class="storage-path-fsinfo mono form-hint">
+                    {{.FSInfo.FSType}} · {{.FSInfo.Device}}{{if .FSInfo.Model}} · {{.FSInfo.Model}}{{end}}
+                </div>
+                {{end}}
+                {{if .StoppedApps}}
+                <div class="storage-stopped-apps-info" id="storage-stopped-{{.Path}}">
+                    <span class="form-hint" style="color:var(--blue-bright)">Újraindításra váró alkalmazások: {{range $i, $name := .StoppedApps}}{{if $i}}, {{end}}{{$name}}{{end}}</span>
+                    <button class="btn btn-xs btn-primary" onclick="storageRestartApps('{{.Path}}')" style="margin-left:.5rem">Alkalmazások indítása</button>
+                </div>
+                {{end}}
+                <div class="storage-path-meta">
+                    {{if .AppDetails}}
+                    <details class="storage-app-details">
+                        <summary class="form-hint" style="cursor:pointer">
+                            {{.AppCount}} alkalmazás használja
+                        </summary>
+                        <div class="storage-app-list">
+                            {{range .AppDetails}}
+                            <div class="storage-app-row">
+                                <a href="/apps/{{.Stack}}" class="storage-app-link">{{.Name}}</a>
+                                {{if .SizeHuman}}<span class="mono form-hint">{{.SizeHuman}}</span>{{end}}
+                                <span class="btn btn-xs btn-outline" style="opacity:.45;cursor:not-allowed" title="Hamarosan"><svg class="ico ico-sm"><use href="#i-upload"/></svg> Mozgatás</span>
+                            </div>
+                            {{end}}
+                        </div>
+                    </details>
+                    {{else}}
+                    <span class="form-hint">Nincs alkalmazás ezen a tárolón</span>
+                    {{end}}
+                </div>
+            <div class="drive-agent-extra" id="agent-extra-{{.Path}}"></div>
+            </div>
+            <div class="storage-path-actions">
+                {{if not .IsDefault}}
+                <form method="POST" action="/settings/storage/default" style="display:inline">
+                    {{$.CSRFField}}
+                    <input type="hidden" name="storage_path" value="{{.Path}}">
+                    <button type="submit" class="btn btn-xs btn-outline">Legyen alapértelmezett</button>
+                </form>
+                {{end}}
+                {{if .Schedulable}}
+                <form method="POST" action="/settings/storage/schedulable" style="display:inline">
+                    {{$.CSRFField}}
+                    <input type="hidden" name="storage_path" value="{{.Path}}">
+                    <input type="hidden" name="schedulable" value="false">
+                    <button type="submit" class="btn btn-xs btn-outline">Letiltás</button>
+                </form>
+                {{else}}
+                <form method="POST" action="/settings/storage/schedulable" style="display:inline">
+                    {{$.CSRFField}}
+                    <input type="hidden" name="storage_path" value="{{.Path}}">
+                    <input type="hidden" name="schedulable" value="true">
+                    <button type="submit" class="btn btn-xs btn-outline">Engedélyezés</button>
+                </form>
+                {{end}}
+                {{if .IsUSB}}
+                <button class="btn btn-xs btn-danger-outline" onclick="storageDisconnect('{{.Path}}', '{{.Label}}', {{.AppCount}})">Leválasztás</button>
+                {{end}}
+                {{if and (not .IsDefault) (eq .AppCount 0)}}
+                <form method="POST" action="/settings/storage/remove" style="display:inline"
+                      onsubmit="return storageRemoveDialog(event, this, 'Biztosan eltávolítja a(z) {{.Path}} adattárolót?')">
+                    {{$.CSRFField}}
+                    <input type="hidden" name="storage_path" value="{{.Path}}">
+                    <button type="submit" class="btn btn-xs btn-danger-outline">Eltávolítás</button>
+                </form>
+                {{end}}
+                {{if and (gt .AppCount 0) .HasOtherPaths}}
+                {{$src := .Path}}
+                <span class="migrate-inline" style="display:inline-flex;gap:.35rem;align-items:center">
+                    <select id="migrate-target-{{.Path}}" class="btn btn-xs btn-outline">
+                        <option value="">Áthelyezés ide…</option>
+                        {{range $.StoragePaths}}{{if and (ne .Path $src) .Schedulable (not .Disconnected) (not .Decommissioned)}}<option value="{{.Path}}">{{.Label}} ({{.Path}})</option>{{end}}{{end}}
+                    </select>
+                    <button class="btn btn-xs btn-outline" onclick="storageMigrateAll('{{.Path}}','{{.Label}}')">Összes adat áthelyezése</button>
+                </span>
+                {{end}}
+                <button class="btn btn-xs btn-danger-outline" onclick="storageDecommission('{{.Path}}','{{.Label}}',{{.AppCount}})">Leszerelés</button>
+            </div>
+            {{end}}
+        </div>
+        {{end}}
+    </div>
+    {{else}}
+    <div class="empty-state" style="padding:1.5rem">
+        Nincs regisztrált adattároló. Adjon hozzá egyet az alábbi űrlappal.
+    </div>
+    {{end}}
+
+    <!-- NAS network storage (Part A2) — a distinct class from the physical drives above. No
+         leválasztás/leszerelés/áthelyezés/törlés; the only lifecycle action is Eltávolítás. -->
+    <div class="storage-section" style="margin-top:1.5rem">
+        <h3 style="margin-bottom:.25rem">Hálózati tárhely (NAS)</h3>
+        <p class="form-hint" style="margin-top:0">
+            Egy NAS-megosztás (NFS vagy SMB) csatlakoztatása nagy méretű médiatartalomhoz (film, fotó, zene).
+            A megosztás kiválasztható médiaalkalmazás adatkönyvtáraként. A hálózati tárhely nem fizikai
+            meghajtó — nincs leszerelés/áthelyezés, csak eltávolítás.
+        </p>
+        {{if .NetworkStoragePaths}}
+        <div class="storage-paths-list">
+            {{range .NetworkStoragePaths}}
+            <div class="storage-path-item{{if eq .Health "unreachable"}} storage-disconnected{{end}}">
+                <div class="storage-path-header">
+                    <div class="storage-path-info">
+                        <span class="storage-path-label">{{.Label}}</span>
+                        <span class="storage-path-path mono">{{.Protocol}} · {{.Server}}:{{.Export}} → {{.Path}}</span>
+                    </div>
+                    <div class="storage-path-badges">
+                        {{if eq .Health "ok"}}<span class="badge badge-ok" title="A megosztás elérhető és csatlakoztatva van">Elérhető</span>
+                        {{else if eq .Health "idle"}}<span class="badge badge-neutral" title="Elérhető, jelenleg készenlétben (igény szerint csatlakozik)">Készenlét</span>
+                        {{else if eq .Health "unreachable"}}<span class="badge badge-warn" title="A NAS jelenleg nem érhető el — az érintett alkalmazások átmenetileg nem olvasnak róla">Nem elérhető</span>
+                        {{else}}<span class="badge badge-neutral" title="Az állapot jelenleg nem lekérdezhető">Ismeretlen</span>{{end}}
+                    </div>
+                </div>
+                <div class="storage-path-actions">
+                    <button class="btn btn-xs btn-danger-outline" onclick="netStorageRemove('{{.Name}}','{{.Label}}')">Eltávolítás</button>
+                </div>
+            </div>
+            {{end}}
+        </div>
+        {{else}}
+        <p class="form-hint">Nincs hálózati tárhely beállítva.</p>
+        {{end}}
+
+        <details style="margin-top:.75rem">
+            <summary class="btn btn-xs btn-primary" style="cursor:pointer;display:inline-block">Hálózati tárhely hozzáadása</summary>
+            <div style="margin-top:.75rem;padding:1rem;border:1px solid var(--border,#ddd);border-radius:6px;max-width:520px">
+                <div class="form-row"><label>Név (azonosító)</label>
+                    <input id="ns-name" type="text" placeholder="pl. media" class="form-input"></div>
+                <div class="form-row"><label>Protokoll</label>
+                    <select id="ns-protocol" class="form-input" onchange="nsToggleSmb()">
+                        <option value="nfs">NFS (ajánlott)</option>
+                        <option value="smb">SMB / CIFS</option>
+                    </select></div>
+                <div class="form-row"><label>Szerver (IP vagy hosztnév)</label>
+                    <input id="ns-server" type="text" placeholder="pl. 192.168.0.10" class="form-input"></div>
+                <div class="form-row"><label id="ns-export-label">Megosztás (NFS export útvonal)</label>
+                    <input id="ns-export" type="text" placeholder="pl. /volume1/media" class="form-input"></div>
+                <div class="form-row"><label>Alkalmazás felhasználói azonosító (uid)</label>
+                    <input id="ns-uid" type="number" value="1000" class="form-input">
+                    <span class="form-hint">A legtöbb médiaalkalmazás 1000-es uid-del fut.</span></div>
+                <div id="ns-smb-creds" style="display:none">
+                    <div class="form-row"><label>SMB felhasználónév</label>
+                        <input id="ns-username" type="text" autocomplete="off" class="form-input"></div>
+                    <div class="form-row"><label>SMB jelszó</label>
+                        <input id="ns-password" type="password" autocomplete="new-password" class="form-input">
+                        <span class="form-hint">A jelszót a gazda ügynök 0600-as fájlba írja; a vezérlő nem tárolja.</span></div>
+                </div>
+                <button class="btn btn-sm btn-primary" style="margin-top:.5rem" onclick="netStorageAdd()">Csatlakoztatás</button>
+                <div id="ns-add-msg" class="form-hint" style="margin-top:.5rem"></div>
+            </div>
+        </details>
+    </div>
+    <script>
+    function nsToggleSmb(){
+        var smb = document.getElementById('ns-protocol').value === 'smb';
+        document.getElementById('ns-smb-creds').style.display = smb ? 'block' : 'none';
+        document.getElementById('ns-export-label').textContent = smb ? 'Megosztás (SMB megosztásnév)' : 'Megosztás (NFS export útvonal)';
+        document.getElementById('ns-export').placeholder = smb ? 'pl. media' : 'pl. /volume1/media';
+    }
+    function netStorageAdd(){
+        var msg = document.getElementById('ns-add-msg');
+        var body = {
+            name: (document.getElementById('ns-name').value||'').trim(),
+            protocol: document.getElementById('ns-protocol').value,
+            server: (document.getElementById('ns-server').value||'').trim(),
+            export: (document.getElementById('ns-export').value||'').trim(),
+            mapped_uid: parseInt(document.getElementById('ns-uid').value||'1000',10),
+            mapped_gid: parseInt(document.getElementById('ns-uid').value||'1000',10),
+            username: (document.getElementById('ns-username').value||''),
+            password: (document.getElementById('ns-password').value||'')
+        };
+        msg.textContent = 'Csatlakoztatás folyamatban…';
+        fetch('/api/storage/netstorage/add',{method:'POST',headers:Object.assign({'Content-Type':'application/json'},csrfHeaders()),body:JSON.stringify(body)})
+            .then(function(r){return r.json();}).then(function(d){
+                if(d.ok){ msg.textContent='Sikeres'; setTimeout(function(){location.reload();},900); }
+                else { msg.textContent='Hiba: '+(d.error||'ismeretlen'); }
+            }).catch(function(e){ msg.textContent='Hiba: '+e; });
+    }
+    function netStorageRemove(name,label){
+        openDialog({title:'Hálózati tárhely eltávolítása', confirmLabel:'Eltávolítás',
+            message:'Biztosan eltávolítja a(z) '+label+' hálózati tárhelyet?\n\nA megosztás leválasztásra kerül; a NAS-on lévő adatok érintetlenek maradnak.',
+            onConfirm:function(){
+        fetch('/api/storage/netstorage/remove',{method:'POST',headers:Object.assign({'Content-Type':'application/json'},csrfHeaders()),body:JSON.stringify({name:name})})
+            .then(function(r){return r.json();}).then(function(d){
+                if(d.ok){ location.reload(); } else { alert('Hiba: '+(d.error||'ismeretlen')); }
+            }).catch(function(e){ alert('Hiba: '+e); });
+            }});
+    }
+    </script>
+
+    <div id="migrate-progress" style="display:none;margin-top:1rem;padding:1rem;border:1px solid var(--blue);border-radius:6px;background:rgba(0,136,204,0.06)">
+        <strong>Adatok áthelyezése</strong>
+        <div id="migrate-progress-body" style="margin-top:.5rem">…</div>
+    </div>
+    <script>
+    // Shared migration progress (used by both migrate-all here and per-app migrate on the app page).
+    function migFmtGB(b){ return (Number(b||0)/1e9).toFixed(1)+' GB'; }
+    function migRender(job){
+        var names={stop:'Alkalmazások leállítása',copy:'Adatok másolása',verify:'Ellenőrzés',flip:'Újratelepítés',redeploy:'Újratelepítés',cleanup:'Forrás törlése'};
+        var s=names[job.phase]||job.phase;
+        if(job.current_app) s+=': '+job.current_app;
+        if(job.phase==='copy'&&job.bytes_total>0){ s+=' ('+Math.floor(100*job.bytes_done/job.bytes_total)+'% — '+migFmtGB(job.bytes_done)+'/'+migFmtGB(job.bytes_total)+')'; }
+        return s+'…';
+    }
+    function migWatch(){
+        var panel=document.getElementById('migrate-progress');
+        var body=document.getElementById('migrate-progress-body');
+        if(panel) panel.style.display='block';
+        function tick(){
+            fetch('/api/storage/migrate/status').then(function(r){return r.json();}).then(function(d){
+                var job=d.data&&d.data.job;
+                if(!job){ if(body) body.textContent='Nincs folyamatban migráció.'; return; }
+                if(body) body.innerHTML=migRender(job);
+                if(job.phase==='done'){ if(body) body.innerHTML+='<br><strong>Kész</strong>'; setTimeout(function(){location.reload();},1500); return; }
+                if(job.phase==='aborted'){ if(body) body.innerHTML+='<br><strong style="color:var(--danger,#c0392b)">Megszakadt: '+(job.error||'')+'</strong><br>A forrás adatai érintetlenek.'; return; }
+                setTimeout(tick,1500);
+            }).catch(function(){ setTimeout(tick,2000); });
+        }
+        tick();
+    }
+    function storageMigrateAll(source,label){
+        var sel=document.getElementById('migrate-target-'+source);
+        var target=sel?sel.value:'';
+        if(!target){ alert('Válassz céltárolót a legördülő menüből.'); return; }
+        openDialog({title:'Összes adat áthelyezése', confirmLabel:'Áthelyezés',
+            message:'Áthelyezed a(z) '+label+' ÖSSZES adatát ide: '+target+'?\n\nAz alkalmazások az áthelyezés alatt rövid időre leállnak. A forrás adatai csak az ellenőrzés és a sikeres újraindítás után törlődnek.',
+            onConfirm:function(){
+        fetch('/api/storage/migrate',{method:'POST',headers:Object.assign({'Content-Type':'application/json'},csrfHeaders()),body:JSON.stringify({source:source,target:target})})
+            .then(function(r){return r.json();}).then(function(d){ if(d.ok){ migWatch(); } else { alert('Hiba: '+(d.error||'ismeretlen')); } })
+            .catch(function(e){ alert('Hiba: '+e); });
+            }});
+    }
+    // Resume view: if a migration is STILL IN PROGRESS when the page loads, show the panel and watch.
+    // Must NOT re-watch a terminal (done/aborted) job: the journal keeps returning the last completed
+    // job indefinitely, and migWatch's done-branch reloads the page — so watching a persisted 'done'
+    // job on every load creates an endless refresh loop. Only the active watcher (started from
+    // storageMigrateAll) should fire the one-time post-completion reload.
+    (function(){ fetch('/api/storage/migrate/status').then(function(r){return r.json();}).then(function(d){ var job=d.data&&d.data.job; if(job && job.phase!=='done' && job.phase!=='aborted'){ migWatch(); } }).catch(function(){}); })();
+    </script>
+
+    <div style="margin-top:1rem;display:flex;gap:.75rem;flex-wrap:wrap">
+        <a href="/storage/init" class="btn btn-sm btn-outline"><svg class="ico ico-sm"><use href="#i-plus"/></svg> Új meghajtó inicializálása</a>
+        <a href="/storage/attach" class="btn btn-sm btn-outline"><svg class="ico ico-sm"><use href="#i-link"/></svg> Meglévő meghajtó csatolása</a>
+    </div>
+
+    <div id="agent-warn-note"></div>
+
+    <div style="margin-top:1.5rem" id="agent-unregistered-wrap" hidden>
+        <div class="section-h"><h3>Nem regisztrált meghajtók</h3><span class="hint">az ügynök által észlelt, még nem regisztrált adatmeghajtók</span></div>
+        <div id="agent-unregistered" class="drive-list"></div>
+    </div>
+
+    <div style="margin-top:1.5rem" id="agent-system-wrap" hidden>
+        <div class="section-h"><h3>Rendszermeghajtók</h3><span class="hint">védett — csak operátori aláírással módosíthatók</span></div>
+        <div id="agent-system" class="drive-list"></div>
+    </div>
+    <div id="confirm-root"></div>
+    <div id="dialog-root"></div>
+    <script>
+window.__registeredPaths=[{{range .StoragePaths}}{{if .Path}}"{{.Path}}",{{end}}{{end}}];
+(function(){
+  function esc(s){ return String(s==null?'':s).replace(/[&<>"]/g,function(c){return {'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;'}[c];}); }
+  function hum(b){ if(!b||b<=0) return ''; var u=['B','KB','MB','GB','TB'],i=0,v=b; while(v>=1024&&i<u.length-1){v/=1024;i++;} return (v>=10||i===0?Math.round(v):v.toFixed(1))+' '+u[i]; }
+  function usageColorClass(p){ if(p>=85) return 'crit'; if(p>=70) return 'warn'; return 'nominal'; }
+  var LOCK_ICO='<svg class="ico ico-sm"><use href="#i-lock"/></svg>';
+  function classTag(d){
+    if(d.class==='fast') return '<span class="tag">gyors</span>';
+    if(d.class==='slow') return '<span class="tag tag-off">lassú</span>';
+    return '';
+  }
+  function roleTag(role){
+    if(role==='system') return '<span class="tag">'+LOCK_ICO+'Rendszer — védett</span>';
+    if(role==='backup') return '<span class="tag">'+LOCK_ICO+'Biztonsági mentés — védett</span>';
+    if(role==='user-data') return '<span class="tag tag-run"><span class="dot"></span>Felhasználói adat</span>';
+    return '<span class="tag">'+LOCK_ICO+'Védett</span>';
+  }
+  function dataTag(d){ return d.data_bearing ? '<span class="tag tag-warn" title="'+esc(d.data_reason)+'">Adatot tartalmaz</span>' : ''; }
+  // regKey is the path a drive is REGISTERED under: the STABLE intermediary path (guest_path,
+  // /mnt/felhom-drives/<name>) the agent reports, else the raw mount_path (legacy). The registry
+  // stores the STABLE path (handleStorageRegister/runStorageInit), so checking the raw mount_path
+  // alone made an enrolled drive read as "Nem regisztrált" + show a spurious Regisztrálás button.
+  function regKey(d){ return d.guest_path || d.mount_path; }
+  function regTag(d, registered){
+    if(!d.mount_path) return '';
+    return registered[regKey(d)] ? '<span class="tag tag-run"><span class="dot"></span>Regisztrálva</span>' : '<span class="tag tag-off"><span class="dot"></span>Nem regisztrált</span>';
+  }
+  // appBackingTag marks the storages that actually hold deployed apps: the internal SSD (app
+  // databases + Docker) and the external user-data drives (large app files). Keyed on the agent's
+  // authoritative role/type — pure presentation, no agent contract change.
+  function appBackingTag(d){
+    if(d.type==='lvmthin') return '<span class="tag">Alkalmazás-rendszer</span>';
+    if(d.role==='user-data') return '<span class="tag">Alkalmazás-adatok</span>';
+    return '';
+  }
+  // purposeDesc explains, in plain Hungarian, what each storage is for — so the "which one do the
+  // apps use?" question is answered per-card. Keyed on type first, then role.
+  function purposeDesc(d){
+    if(d.type==='lvmthin') return 'Belső SSD — a szerver rendszere, a Docker és a telepített alkalmazások adatbázisai itt találhatók.';
+    if(d.type==='local'||d.type==='dir') return 'Host tárhely — rendszer-sablonok, ISO-k, host szintű mentések. Nem tárol alkalmazásadatot.';
+    if(d.type==='pbs'||d.role==='backup') return 'A biztonsági mentések tárhelye.';
+    if(d.role==='user-data') return 'Külső adattároló — a telepített alkalmazások nagy méretű fájljai (média, dokumentumok) ide kerülnek. Más meghajtók biztonsági mentési céljaként is szolgálhat.';
+    return '';
+  }
+  function capBar(d){
+    if(!d.total_bytes || d.total_bytes<=0) return '';
+    var pct = d.used_fraction ? d.used_fraction*100 : (d.used_bytes/d.total_bytes*100);
+    pct = Math.max(0, Math.min(100, pct));
+    return '<div class="drive-cap meter '+usageColorClass(pct)+'"><div class="meter-track"><div class="meter-fill" style="width:'+pct.toFixed(1)+'%"></div></div>'
+      +'<div class="drive-cap-label">'+hum(d.used_bytes)+' / '+hum(d.total_bytes)+' ('+pct.toFixed(0)+'%)</div></div>';
+  }
+  function actions(d, registered){
+    // Destructive controls ONLY for user-data drives that are mounted under /mnt. System/backup get none.
+    if(d.role!=='user-data' || !d.mount_path || d.mount_path.indexOf('/mnt/')!==0) return '';
+    var dev = esc(d.backing_device||''), mpRaw = esc(d.mount_path), reg = esc(regKey(d));
+    var btns = '';
+    // Two distinct path arguments (the intermediary model):
+    //   - registerDrive posts the RAW mount_path — its agent guest-attach operates on the raw mount
+    //     (handleStorageRegister maps it to the stable path for the registry).
+    //   - eject/wipe post the STABLE (registered) path — their handlers map it to raw for the agent via
+    //     agentWhere() AND deregister it from the registry (which stores the stable path). Posting the
+    //     raw path here would unmount the drive but leave the stable registry entry orphaned.
+    if(!registered[regKey(d)]){
+      btns += '<button class="btn btn-xs btn-primary" onclick="registerDrive(\''+mpRaw+'\')">Regisztrálás</button> ';
+    }
+    btns += '<button class="btn btn-xs btn-danger-outline" onclick="confirmEject(\''+reg+'\')">Leválasztás</button>';
+    if(d.backing_device){ btns += ' <button class="btn btn-xs btn-danger-outline" onclick="confirmWipe(\''+dev+'\',\''+reg+'\')">Törlés…</button>'; }
+    return '<div class="drive-actions">'+btns+'</div>';
+  }
+  // Unified drive view (D1): the agent disk list ENRICHES the registry cards in place
+  // (role tag + durable-id + agent-only actions), and two extra groups render below:
+  // protected system/backup drives (read-only) and unregistered user-data drives.
+  function driveRow(d, registered, withActions){
+    var sub = esc(d.type)+' · '+esc(d.backing_device||'—')+(d.mount_path?' · '+esc(regKey(d)):'');
+    var badges = roleTag(d.role)+appBackingTag(d)+classTag(d)+dataTag(d);
+    if(withActions) badges += regTag(d, registered);
+    var purpose = purposeDesc(d);
+    return '<div class="drive-card role-'+esc(d.role||'system')+'">'
+      +'<div class="drive-card-top"><div class="drive-id"><span class="drive-name">'+esc(d.name)+'</span><span class="drive-sub">'+sub+'</span></div>'
+      +'<div class="drive-badges">'+badges+'</div></div>'
+      +(purpose?'<div class="drive-purpose">'+esc(purpose)+'</div>':'')
+      +(d.durable_id?'<div class="drive-sub mono">'+esc(d.durable_id)+'</div>':'')
+      +capBar(d)
+      +(withActions?actions(d,registered):'')
+      +'</div>';
+  }
+  function enrichCard(d, registered){
+    var slot=document.getElementById('agent-extra-'+regKey(d));
+    if(!slot) return false;
+    var extra='<div class="metarows" style="margin:.4rem 0 0">'
+      +'<span class="metarow">'+roleTag(d.role)+'</span>'
+      +(d.class?'<span class="metarow">'+classTag(d)+'</span>':'')
+      +(d.durable_id?'<span class="metarow mono" title="Tartós azonosító">'+esc(d.durable_id)+'</span>':'')
+      +'</div>'
+      +actions(d,registered);
+    slot.innerHTML=extra;
+    return true;
+  }
+  async function load(){
+    var warn=document.getElementById('agent-warn-note');
+    try{
+      var r=await fetch('/api/disks'); var j=await r.json();
+      if(!j.ok) throw new Error(j.error||'Nem elérhető');
+      var disks=(j.data&&j.data.disks)||[];
+      var registered={}; (window.__registeredPaths||[]).forEach(function(p){registered[p]=true;});
+      var sysHtml='', unregHtml='';
+      disks.forEach(function(d){
+        if(d.role==='user-data'){
+          if(registered[regKey(d)] && enrichCard(d, registered)) return; // one card, enriched in place
+          unregHtml+=driveRow(d, registered, true);
+        }else{
+          sysHtml+=driveRow(d, registered, false); // protected: read-only, lock tag, NO actions
+        }
+      });
+      var sysWrap=document.getElementById('agent-system-wrap');
+      var unregWrap=document.getElementById('agent-unregistered-wrap');
+      if(sysHtml){ document.getElementById('agent-system').innerHTML=sysHtml; sysWrap.hidden=false; }
+      if(unregHtml){ document.getElementById('agent-unregistered').innerHTML=unregHtml; unregWrap.hidden=false; }
+    }catch(e){
+      if(warn) warn.innerHTML='<div class="alert alert-warning" style="margin-top:1rem">Az ügynök nem elérhető — élő meghajtóadatok nélkül.</div>';
+    }
+  }
+
+  // ---- type-to-confirm modal (destructive user-data actions) ----
+  function closeModal(){ document.getElementById('confirm-root').innerHTML=''; }
+  window.__closeConfirm=closeModal;
+  async function openConfirm(opts){
+    // opts: {title, mount, mountName, danger, onConfirm}
+    var apps=[], copies=[];
+    try{
+      var r=await fetch('/api/storage/impact?where='+encodeURIComponent(opts.mount));
+      var j=await r.json(); if(j.ok && j.data){ apps=j.data.apps||[]; copies=j.data.backup_copies||[]; }
+    }catch(e){}
+    var appsHtml = apps.length
+      ? '<p>A művelet után a következő alkalmazások <strong>nem fognak működni</strong>:</p><ul class="confirm-apps">'+apps.map(function(a){return '<li>'+esc(a)+'</li>';}).join('')+'</ul>'
+      : '<p class="form-hint">Ehhez a meghajtóhoz jelenleg nincs telepített alkalmazás rendelve.</p>';
+    // P4 (4B): this drive may also hold cross-drive backup COPIES of other apps — a wipe removes them.
+    var copiesHtml = copies.length
+      ? '<div class="alert alert-warning" style="margin-top:.5rem">Ez a meghajtó más alkalmazások <strong>biztonsági másolatait</strong> is tárolja — a törlés ezeket is eltávolítja:<ul class="confirm-apps">'+copies.map(function(a){return '<li>'+esc(a)+'</li>';}).join('')+'</ul><span class="form-hint">(A másolatok redundánsak — az eredetik a forrás-meghajtón maradnak.)</span></div>'
+      : '';
+    var root=document.getElementById('confirm-root');
+    root.innerHTML='<div class="confirm-overlay" onclick="if(event.target===this)__closeConfirm()"><div class="confirm-box">'
+      +'<h3>'+esc(opts.title)+'</h3>'
+      +'<div class="alert alert-warning">'+esc(opts.danger)+'</div>'
+      +appsHtml
+      +copiesHtml
+      +'<div class="confirm-input"><label>Megerősítéshez írja be a csatlakoztatási nevet: <strong class="mono">'+esc(opts.mountName)+'</strong></label>'
+      +'<input type="text" id="confirm-type" class="form-control" autocomplete="off" placeholder="'+esc(opts.mountName)+'" oninput="document.getElementById(\'confirm-go\').disabled=(this.value!==\''+esc(opts.mountName)+'\')"></div>'
+      +'<div class="form-actions"><button id="confirm-go" class="btn btn-danger-outline" disabled>Megerősítés</button>'
+      +'<button class="btn btn-outline" onclick="__closeConfirm()">Mégsem</button></div>'
+      +'<div id="confirm-result" style="margin-top:.6rem"></div></div></div>';
+    document.getElementById('confirm-go').onclick=opts.onConfirm;
+  }
+
+  // registerDrive records an already-mounted, unregistered user-data drive into the StoragePath
+  // registry (no format, no eject) — makes the existing mount usable (schedulable + FileBrowser sync).
+  window.registerDrive=async function(where){
+    try{
+      var r=await fetch('/api/storage/register',{method:'POST',headers:Object.assign({'Content-Type':'application/json'},csrfHeaders()),body:JSON.stringify({where:where})});
+      var j=await r.json(); if(!j.ok){ alert('Regisztráció sikertelen: '+(j.error||'')); return; }
+      location.reload();
+    }catch(e){ alert('Hiba: '+e.message); }
+  };
+  window.confirmEject=function(where){
+    // The confirm name is the drive BASENAME (matches the server's path.Base(where) check); `where` may
+    // be the stable /mnt/felhom-drives/<name> path, so strip the whole directory, not just the /mnt/ prefix.
+    var name=where.split('/').filter(Boolean).pop()||where;
+    openConfirm({title:'Meghajtó leválasztása', mount:where, mountName:name,
+      danger:'A meghajtó leválasztásra kerül. Az adatok megmaradnak, de az ott tárolt alkalmazások elvesztik a tárhelyüket, amíg újra nem csatolja.',
+      onConfirm:async function(){
+        var out=document.getElementById('confirm-result'); out.innerHTML='<p class="form-hint">Leválasztás folyamatban…</p>';
+        try{
+          var r=await fetch('/api/storage/eject',{method:'POST',headers:Object.assign({'Content-Type':'application/json'},csrfHeaders()),body:JSON.stringify({where:where})});
+          var j=await r.json(); if(!j.ok){ out.innerHTML='<div class="alert alert-error">Hiba: '+esc(j.error||'')+'</div>'; return; }
+          location.reload();
+        }catch(e){ out.innerHTML='<div class="alert alert-error">Hiba: '+esc(e.message)+'</div>'; }
+      }});
+  };
+  window.confirmWipe=function(device, where){
+    // Basename (matches the server's path.Base(where) type-to-confirm check); `where` may be the stable path.
+    var name=where.split('/').filter(Boolean).pop()||where;
+    openConfirm({title:'Meghajtó törlése (formázás)', mount:where, mountName:name,
+      danger:'FIGYELEM: a meghajtón lévő ÖSSZES ADAT véglegesen törlődik (formázás). Ez nem vonható vissza.',
+      onConfirm:async function(){
+        var out=document.getElementById('confirm-result'); out.innerHTML='<p class="form-hint">Törlés folyamatban…</p>';
+        try{
+          var r=await fetch('/api/storage/wipe',{method:'POST',headers:Object.assign({'Content-Type':'application/json'},csrfHeaders()),body:JSON.stringify({device:device, where:where, mount_name:name})});
+          var j=await r.json(); if(!j.ok){ out.innerHTML='<div class="alert alert-error">Hiba: '+esc(j.error||'')+'</div>'; return; }
+          location.reload();
+        }catch(e){ out.innerHTML='<div class="alert alert-error">Hiba: '+esc(e.message)+'</div>'; }
+      }});
+  };
+  load();
+})();
+    </script>
+
+    <details class="storage-add-details">
+        <summary class="btn btn-sm btn-outline" style="margin-top:.75rem;cursor:pointer">Már csatlakoztatott tárhely hozzáadása kézzel</summary>
+        <form method="POST" action="/settings/storage/add" class="storage-add-form">
+            {{.CSRFField}}
+            <div class="form-group">
+                <label for="storage_path">Elérési út</label>
+                <input type="text" id="storage_path" name="storage_path" class="form-control"
+                       placeholder="/mnt/hdd_1" required>
+                <span class="form-hint">Pl. /mnt/hdd_1 — a meghajtónak már csatolva kell lennie</span>
+            </div>
+            <div class="form-group">
+                <label for="storage_label">Megnevezés (opcionális)</label>
+                <input type="text" id="storage_label" name="storage_label" class="form-control"
+                       placeholder="Külső HDD 1TB">
+            </div>
+            <label class="toggle" style="margin-bottom:1rem">
+                <input type="checkbox" name="storage_default" value="true">
+                <span class="toggle-label">Legyen alapértelmezett új telepítéseknél</span>
+            </label>
+            <button type="submit" class="btn btn-primary">Hozzáadás</button>
+        </form>
+    </details>
+</div>
+
+<script>
+// Light overlay dialog (D1) — replaces the native blocking browser dialogs: same texts,
+// reuses the .confirm-overlay/.confirm-box pattern. typeToConfirm adds the typed-name gate
+// ONLY where the old flow already had one.
+function escText(s){var d=document.createElement('div');d.textContent=String(s==null?'':s);return d.innerHTML;}
+function closeDialog(){ var r=document.getElementById('dialog-root'); if(r) r.innerHTML=''; }
+function openDialog(opts){
+    var root=document.getElementById('dialog-root');
+    if(!root) return;
+    var typeGate=opts.typeToConfirm||'';
+    var html='<div class="confirm-overlay" onclick="if(event.target===this)document.getElementById(\'dialog-cancel\').click()"><div class="confirm-box">'
+        +'<h3>'+escText(opts.title||'Megerősítés')+'</h3>'
+        +'<p style="white-space:pre-line">'+escText(opts.message||'')+'</p>';
+    if(typeGate){
+        html+='<div class="confirm-input"><label>Megerősítéshez írja be: <strong class="mono">'+escText(typeGate)+'</strong></label>'
+            +'<input type="text" id="dialog-type" class="form-control" autocomplete="off" placeholder="'+escText(typeGate)+'"></div>';
+    }
+    html+='<div class="form-actions"><button id="dialog-go" class="btn '+(typeGate?'btn-danger-outline':'btn-primary')+'"'+(typeGate?' disabled':'')+'>'+escText(opts.confirmLabel||'Megerősítés')+'</button>'
+        +'<button type="button" class="btn btn-outline" id="dialog-cancel">Mégsem</button></div>'
+        +'</div></div>';
+    root.innerHTML=html;
+    var go=document.getElementById('dialog-go');
+    if(typeGate){
+        document.getElementById('dialog-type').oninput=function(){ go.disabled=(this.value.trim()!==typeGate); };
+    }
+    go.onclick=function(){ closeDialog(); if(opts.onConfirm) opts.onConfirm(); };
+    document.getElementById('dialog-cancel').onclick=function(){ closeDialog(); if(opts.onCancel) opts.onCancel(); };
+}
+// Overlay-confirmed POST form submit (registry drive-remove forms).
+function storageRemoveDialog(ev, form, msg){
+    ev.preventDefault();
+    openDialog({title:'Meghajtó eltávolítása', message:msg, confirmLabel:'Eltávolítás', onConfirm:function(){ form.submit(); }});
+    return false;
+}
+
+function editStorageLabel(path, currentLabel) {
+    var wrap = document.getElementById('label-wrap-' + path);
+    if (!wrap) return;
+    var csrfTok = (document.querySelector('meta[name="csrf-token"]') || {}).content || '';
+    wrap.innerHTML = '<form method="POST" action="/settings/storage/label" style="display:inline-flex;gap:.5rem;align-items:center">' +
+        '<input type="hidden" name="_csrf" value="' + csrfTok + '">' +
+        '<input type="hidden" name="storage_path" value="' + path + '">' +
+        '<input type="text" name="storage_label" class="form-control" value="' + currentLabel.replace(/"/g, '&quot;') + '" style="width:200px;padding:.3rem .5rem;font-size:.9rem" maxlength="50">' +
+        '<button type="submit" class="btn btn-xs btn-primary">OK</button>' +
+        '<button type="button" class="btn btn-xs btn-outline" onclick="cancelEditLabel(\'' + path + '\', \'' + currentLabel.replace(/'/g, "\\'") + '\')">&#215;</button>' +
+        '</form>';
+    wrap.querySelector('input[name=storage_label]').focus();
+}
+function storageDisconnect(path, label, appCount) {
+    var msg = 'Biztos leválasztja a meghajtót: ' + label + '?';
+    if (appCount > 0) msg += '\n\nA rajta futó ' + appCount + ' alkalmazás le fog állni.';
+    msg += '\n\nA meghajtó ezután biztonságosan eltávolítható.';
+    openDialog({title:'Meghajtó leválasztása', message:msg, confirmLabel:'Leválasztás', onConfirm:function(){ doStorageDisconnect(path); }});
+}
+function doStorageDisconnect(path) {
+    fetch('/api/storage/disconnect', {
+        method: 'POST',
+        headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
+        body: JSON.stringify({where: path})
+    }).then(function(r) { return r.json(); }).then(function(data) {
+        if (data.ok) {
+            alert('A meghajtó biztonságosan eltávolítható.');
+            location.reload();
+        } else {
+            alert('Hiba: ' + (data.error || 'ismeretlen'));
+        }
+    }).catch(function(e) { alert('Hiba: ' + e); });
+}
+function storageReconnect(path) {
+    var actionsDiv = document.getElementById('storage-actions-' + path);
+    if (actionsDiv) actionsDiv.innerHTML = '<span class="form-hint">Csatlakoztatás...</span>';
+    fetch('/api/storage/reconnect', {
+        method: 'POST',
+        headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
+        body: JSON.stringify({where: path})
+    }).then(function(r) { return r.json(); }).then(function(data) {
+        if (data.ok) {
+            location.reload();
+        } else {
+            alert('Hiba: ' + (data.error || 'ismeretlen'));
+            if (actionsDiv) actionsDiv.innerHTML = '<button class="btn btn-xs btn-primary" onclick="storageReconnect(\'' + path + '\')">Csatlakoztatás</button>';
+        }
+    }).catch(function(e) {
+        alert('Hiba: ' + e);
+        if (actionsDiv) actionsDiv.innerHTML = '<button class="btn btn-xs btn-primary" onclick="storageReconnect(\'' + path + '\')">Csatlakoztatás</button>';
+    });
+}
+function storageRestartApps(path) {
+    fetch('/api/storage/restart-apps', {
+        method: 'POST',
+        headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
+        body: JSON.stringify({where: path})
+    }).then(function(r) { return r.json(); }).then(function(data) {
+        if (data.ok) {
+            var r2 = data.restarted || [];
+            if (r2.length) alert('Elindítva: ' + r2.join(', '));
+            location.reload();
+        } else {
+            alert('Hiba: ' + (data.error || 'ismeretlen'));
+        }
+    }).catch(function(e) { alert('Hiba: ' + e); });
+}
+// H2: decommission a drive (non-destructive). If a migrate target is picked in the inline select →
+// migrate-then-decommission; otherwise decommission-anyway with type-to-confirm.
+function storageDecommission(path, label, appCount) {
+    var sel = document.getElementById('migrate-target-' + path);
+    var target = sel ? sel.value : '';
+    if (target) {
+        openDialog({title:'Leszerelés áthelyezéssel', confirmLabel:'Leszerelés',
+            message:'Leszerelés áthelyezéssel: minden adat átmásolása ide: ' + target + ', majd a(z) ' + label + ' leszerelése?\n\nAz adatok NEM törlődnek.',
+            onConfirm:function(){ doStorageDecommission({where: path, mode: 'migrate', target: target}); }});
+    } else {
+        var name = path.split('/').pop();
+        openDialog({title:'Meghajtó leszerelése', confirmLabel:'Leszerelés', typeToConfirm:name,
+            message:'A(z) ' + label + ' leszereléséhez (áthelyezés nélkül) írja be a meghajtó nevét megerősítésként.' +
+                (appCount > 0 ? '\n\nFIGYELEM: ' + appCount + ' alkalmazás leáll (az adatok megmaradnak).' : ''),
+            onConfirm:function(){ doStorageDecommission({where: path, mode: 'anyway', mount_name: name}); }});
+    }
+}
+function doStorageDecommission(body) {
+    fetch('/api/storage/decommission', {
+        method: 'POST',
+        headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
+        body: JSON.stringify(body)
+    }).then(function(r) { return r.json(); }).then(function(data) {
+        if (data.ok) { alert('Leszerelés elindítva.'); location.reload(); }
+        else { alert('Hiba: ' + (data.error || 'ismeretlen')); }
+    }).catch(function(e) { alert('Hiba: ' + e); });
+}
+// H3: one-click re-enroll a decommissioned/ejected drive — clears the marker, re-attaches under the
+// parent, restarts the gate-stopped apps (data is intact).
+function storageReEnroll(path, label) {
+    openDialog({title:'Visszacsatlakoztatás', confirmLabel:'Visszacsatlakoztatás',
+        message:'Visszacsatlakoztatja a(z) ' + label + ' meghajtót?\n\nAz adatok érintetlenek; a leállított alkalmazások újraindulnak.',
+        onConfirm:function(){ doStorageReEnroll(path); }});
+}
+function doStorageReEnroll(path) {
+    fetch('/api/storage/reconnect', {
+        method: 'POST',
+        headers: Object.assign({'Content-Type': 'application/json'}, csrfHeaders()),
+        body: JSON.stringify({where: path})
+    }).then(function(r) { return r.json(); }).then(function(data) {
+        if (data.ok) { location.reload(); }
+        else { alert('Hiba: ' + (data.error || 'ismeretlen')); }
+    }).catch(function(e) { alert('Hiba: ' + e); });
+}
+function cancelEditLabel(path, label) {
+    var wrap = document.getElementById('label-wrap-' + path);
+    if (!wrap) return;
+    // M11: Use DOM manipulation with textContent to prevent XSS if label contains HTML.
+    wrap.innerHTML = '';
+    var span = document.createElement('span');
+    span.className = 'storage-path-label';
+    span.id = 'label-display-' + path;
+    span.textContent = label;
+    var btn = document.createElement('button');
+    btn.className = 'btn btn-xs btn-ghost';
+    btn.setAttribute('title', 'Átnevezés');
+    btn.innerHTML = '<svg class="ico ico-sm"><use href="#i-pencil"/></svg>';
+    btn.addEventListener('click', function() { editStorageLabel(path, label); });
+    wrap.appendChild(span);
+    wrap.appendChild(document.createTextNode(' '));
+    wrap.appendChild(btn);
+}
+</script>
+{{template "layout_end" .}}
+{{end}}

controller/internal/web/templates/style.css

@@ -1976,26 +1976,6 @@ a.stat-card:hover {
     margin-top: auto;
     border-top: 1px solid var(--line);
 }
-.sidebar-settings-link {
-    display: flex;
-    align-items: center;
-    gap: .6rem;
-    padding: .75rem 1.5rem;
-    color: var(--text-2);
-    text-decoration: none;
-    font-size: .95rem;
-    font-weight: 500;
-    transition: color 0.2s ease, background 0.2s ease;
-}
-.sidebar-settings-link:hover {
-    color: var(--blue-bright);
-    background: var(--blue-dim);
-}
-.sidebar-settings-link.active {
-    color: var(--blue-bright);
-    background: var(--blue-dim);
-    border-left: 3px solid var(--blue);
-}
 
 /* --- Backup page: Storage overview grid --- */
 .storage-overview-grid {
@@ -3143,7 +3123,6 @@ a.stat-card:hover {
 /* badges missing from the global sheet */
 .badge-ok { background: var(--blue-dim); color: var(--blue); }
 .badge-neutral { background: var(--bg-2); color: var(--text-2); }
-.badge-lock { background: var(--warn-dim); color: var(--warn); }
 .badge-muted { background: var(--bg-2); color: var(--text-3); }
 .badge-info { background: var(--blue-dim); color: var(--blue-bright); }
 /* Backup-page tier divider between the whole-guest section and the per-app section. */
@@ -3158,7 +3137,6 @@ a.stat-card:hover {
     margin: 0 0 .75rem; padding: .5rem .75rem;
     background: var(--blue-dim); border-left: 3px solid var(--blue); border-radius: var(--radius);
 }
-.badge .lock-ico { margin-right: .25rem; }
 span.mono, .mono { font-family: var(--font-data); }
 
 /* Type-to-confirm modal (destructive user-data eject/wipe) */
@@ -3244,3 +3222,21 @@ span.mono, .mono { font-family: var(--font-data); }
 .login-title .title-accent {
     color: var(--blue-bright);
 }
+
+/* Sidebar settings group (D1) — group label + indented sub-links. */
+.nav-group-label {
+    padding: .75rem 1.5rem .25rem;
+    font-size: .68rem;
+    font-weight: 700;
+    letter-spacing: .1em;
+    text-transform: uppercase;
+    color: var(--text-3);
+}
+.nav-links-sub {
+    padding: 0 0 .5rem;
+    flex: none;
+}
+.nav-links-sub a {
+    padding: .5rem 1.5rem .5rem 1.75rem;
+    font-size: .88rem;
+}

controller/scripts/emoji_gate.py

@@ -0,0 +1,69 @@
+# -*- coding: utf-8 -*-
+"""D1 §10 Python emoji gate — Windows grep silently fails to match multibyte emoji (the D0
+grep-gate zero was a false negative). This scans templates by Unicode codepoint.
+
+Run from controller/:  python scripts/emoji_gate.py
+Exit 1 if any emoji/pictograph remains in web+setup templates.
+"""
+import io, os, sys, unicodedata
+
+ROOTS = [
+    os.path.join("internal", "web", "templates"),
+    os.path.join("internal", "setup", "templates"),
+]
+
+# Codepoint ranges that count as "emoji / pictographs / dingbats" for UI-copy purposes.
+# Deliberately does NOT flag Hungarian letters, typographic quotes/dashes, the middle dot (·),
+# arrows used as affordances (→ ↗ ↻ ↑ ↓), the multiplication sign (×), or box-drawing.
+def is_emoji(ch):
+    o = ord(ch)
+    ranges = [
+        (0x1F300, 0x1FAFF),  # Misc symbols & pictographs, emoticons, transport, supplemental, symbols-ext
+        (0x2600, 0x26FF),    # Misc symbols (☀ ⚙ ⚠ ☁ …)
+        (0x2700, 0x27BF),    # Dingbats (✅ ✂ ✈ ✏ ✓? no — see allow)
+        (0x1F000, 0x1F0FF),  # Mahjong/dominoes/cards
+        (0xFE00, 0xFE0F),    # Variation selectors (emoji presentation)
+        (0x1F1E6, 0x1F1FF),  # Regional indicators
+    ]
+    if any(a <= o <= b for a, b in ranges):
+        return True
+    return False
+
+# Dingbat codepoints that are legitimate UI glyphs (checkmarks/crosses used as plain text marks,
+# not emoji). We keep these OUT of the ban — they render as monochrome text, not color emoji.
+ALLOW = set("✓✗✔✘•●○■▶")  # ✓ ✗ ✔ ✘ • ● ○ ■ ▶
+
+
+def scan(path):
+    hits = []
+    for lineno, line in enumerate(io.open(path, encoding="utf-8"), 1):
+        for ch in line:
+            if ch in ALLOW:
+                continue
+            if is_emoji(ch):
+                try:
+                    name = unicodedata.name(ch)
+                except ValueError:
+                    name = "U+%04X" % ord(ch)
+                hits.append((lineno, ch, name))
+    return hits
+
+
+def main():
+    total = 0
+    for root in ROOTS:
+        for fn in sorted(os.listdir(root)):
+            if not fn.endswith(".html"):
+                continue
+            path = os.path.join(root, fn)
+            for lineno, ch, name in scan(path):
+                total += 1
+                print("%s:%d  %s  %s" % (fn, lineno, ch, name))
+    if total:
+        print("EMOJI GATE FAILED: %d emoji found" % total)
+        sys.exit(1)
+    print("emoji gate OK — no emoji in web/setup templates")
+
+
+if __name__ == "__main__":
+    main()

controller/scripts/template_id_gate.py

@@ -0,0 +1,91 @@
+# -*- coding: utf-8 -*-
+"""D1 §10 JS element-ID integrity gate.
+
+For every template under internal/web/templates and internal/setup/templates, extract each
+getElementById('X') / querySelector('#X') literal used by the file's inline JS and assert an
+id="X" exists in the SAME file — or that the ID is created by that file's own JS (innerHTML /
+insertAdjacentHTML string containing id="X" / id='X'), or is explicitly allowlisted below with
+a justification.
+
+Exit 1 on any unresolved reference. Run from the repo's controller/ directory:
+    python scripts/template_id_gate.py
+"""
+import io, os, re, sys
+
+ROOTS = [
+    os.path.join("internal", "web", "templates"),
+    os.path.join("internal", "setup", "templates"),
+]
+
+# Dynamic-ID exceptions: (template, id-prefix-or-name) -> justification.
+# Suffix-parameterized IDs (id + variable) are handled generically below; these are the rest.
+ALLOW = {
+    # layout.html builds the alert/delete/remove modals entirely in JS and later looks them up.
+    ("layout.html", "alert-modal"): "created by showAlert() via innerHTML in the same file",
+    ("layout.html", "delete-modal"): "created by deleteOrphanStack() via innerHTML",
+    ("layout.html", "remove-modal"): "created by removeStack() via innerHTML",
+    ("layout.html", "confirm-delete-btn"): "created inside the delete-modal innerHTML",
+    ("layout.html", "confirm-remove-btn"): "created inside the remove-modal innerHTML",
+    ("layout.html", "delete-hdd-check"): "created inside the delete-modal innerHTML",
+    ("layout.html", "remove-hdd-check"): "created inside the remove-modal innerHTML",
+    ("layout.html", "remove-backup-check"): "created inside the remove-modal innerHTML",
+    ("layout.html", "remove-hdd-keep-warning"): "created inside the remove-modal innerHTML",
+    ("layout.html", "sync-btn"): "lives on stacks.html; syncTemplates() is shared layout JS guarded by if(!btn)return",
+    ("layout.html", "sync-toast"): "lives on stacks.html; guarded null-check",
+}
+
+GET_RE = re.compile(r"getElementById\(\s*['\"]([A-Za-z0-9_-]+)['\"]\s*\)")
+GET_DYN_RE = re.compile(r"getElementById\(\s*['\"]([A-Za-z0-9_-]+)['\"]\s*\+")
+QS_RE = re.compile(r"querySelector\(\s*['\"]#([A-Za-z0-9_-]+)['\"]\s*\)")
+ID_ATTR_RE = re.compile(r"""id=["']([A-Za-z0-9_{}\. $-]+)["']""")
+ID_IN_JS_RE = re.compile(r"""id=\\?["']([A-Za-z0-9_-]+)\\?["']""")
+
+
+def check(path):
+    fname = os.path.basename(path)
+    src = io.open(path, encoding="utf-8").read()
+    static_refs = set(GET_RE.findall(src)) | set(QS_RE.findall(src))
+    dyn_prefixes = set(GET_DYN_RE.findall(src))
+    # static refs regex also matches the dynamic form's literal — subtract prefixes used with '+'
+    static_refs -= dyn_prefixes
+    defined = set(ID_ATTR_RE.findall(src)) | set(ID_IN_JS_RE.findall(src))
+    defined_prefixes = tuple(d.split("{{")[0] for d in defined if "{{" in d or d.endswith("-"))
+
+    problems = []
+    for ref in sorted(static_refs):
+        if ref in defined:
+            continue
+        # a template-parameterized id like id="field-{{.EnvVar}}" legitimately renders
+        # ids such as field-SUBDOMAIN — match static refs against those prefixes
+        if defined_prefixes and ref.startswith(defined_prefixes):
+            continue
+        if (fname, ref) in ALLOW:
+            continue
+        problems.append("static #%s not defined in %s" % (ref, fname))
+    for pref in sorted(dyn_prefixes):
+        # a dynamic lookup 'x-' + var needs SOME id starting with that prefix (template- or JS-created)
+        if any(d.startswith(pref) for d in defined) or pref in defined_prefixes:
+            continue
+        if (fname, pref) in ALLOW:
+            continue
+        problems.append("dynamic prefix #%s* not defined in %s" % (pref, fname))
+    return problems
+
+
+def main():
+    bad = []
+    for root in ROOTS:
+        for fn in sorted(os.listdir(root)):
+            if not fn.endswith(".html"):
+                continue
+            bad += check(os.path.join(root, fn))
+    if bad:
+        print("INTEGRITY GATE FAILED (%d):" % len(bad))
+        for b in bad:
+            print("  -", b)
+        sys.exit(1)
+    print("integrity gate OK — every JS element-ID reference resolves within its own template")
+
+
+if __name__ == "__main__":
+    main()