P3 follow-up: editable target dir, conditional --no-ownership, UK lint

Three small follow-ups from review:

1. Restore target is now operator-editable. Default value is the
   literal '\$HOME/rm-restore/<job-id>/' (agent expands \$HOME at
   run time using os.UserHomeDir(); also handles \${HOME} and ~/
   prefixes). Operator can replace with any absolute path.
   - ui_restore.go validates the input is either absolute or starts
     with one of the recognised prefixes; other env-var refs (\$PATH
     etc.) are deliberately rejected so operator paths can't pick up
     arbitrary agent env values.
   - host_restore.html replaces the read-only mono-text display with
     a real <input>; help text spells out that \$HOME resolves
     agent-side and <job-id> is substituted on dispatch.
   - install.sh + the systemd unit prep /root/rm-restore so the
     default works under the sandbox: ReadWritePaths gains a soft
     '-/root/rm-restore' entry (the '-' makes the bind-mount soft-fail
     if missing, but install.sh pre-creates it root-owned 0700).

2. --no-ownership flag now gated on restic version. The flag was
   added in restic 0.17 and 0.16 rejects it. Previously dropped it
   wholesale — that meant new-dir restores silently preserved
   ownership against design intent on 0.17+. Now the agent threads
   its detected restic version (sysinfo already collects it) through
   runner.Config -> restic.Env, and RunRestore appends --no-ownership
   only when AtLeastVersion(0, 17) returns true. 0.16 hosts still
   restore with original uid/gid; help text in the wizard explicitly
   notes this. The previous 'Original ownership is preserved' copy
   was wrong for new-dir mode and is corrected.

3. golangci-lint misspell locale switched US -> UK and the codebase
   swept (73 corrections, mostly behaviour/serialise/recognise/honour).
   Wire-format ErrorCode 'unauthorized' -> 'unauthorised' is a tiny
   contract change but the agent doesn't parse those codes today and
   no external API consumers exist yet. Tests passed before + after.

Tests:
- internal/restic/version_test.go covers Env.AtLeastVersion across
  edge cases (empty, exact match, patch above, minor below, non-
  numeric) and expandHome on \$HOME / \${HOME} / ~/, plus
  pass-through for absolute paths and refusal of other env vars.
- ui_restore_test updated: TargetDir now starts '\$HOME/rm-restore/'
  with the job_id substituted into the placeholder.

Live verified on the smoke env: default target restored to
/root/rm-restore/<job-id>/ as the agent's expanded \$HOME (2 files,
14 bytes); custom override '/tmp/custom-restore/<job-id>/' restored
into the agent's PrivateTmp namespace (1 file, 6 bytes); both jobs
'succeeded', exit 0.

internal/server/http/ui_restore.go

@@ -5,7 +5,6 @@ import (
 	"errors"
 	"log/slog"
 	stdhttp "net/http"
-	"path"
 	"sort"
 	"strings"
 	"time"
@@ -197,10 +196,18 @@ func (s *Server) handleUIRestorePost(w stdhttp.ResponseWriter, r *stdhttp.Reques
 			return
 		}
 	} else {
-		// New-directory mode: server picks the path so the operator
-		// can't escape /var/restic-restore. Operator-supplied
-		// target_dir is intentionally ignored.
-		targetDir = ""
+		// New-directory mode: trust the operator's chosen target.
+		// Empty falls back to the default. Validate it's either
+		// absolute or starts with $HOME / ~/ (the agent expands
+		// these at run time).
+		if targetDir == "" {
+			targetDir = defaultRestoreTargetDir()
+		}
+		if !looksLikeRestoreTarget(targetDir) {
+			rerender("Target must be an absolute path, or start with $HOME or ~/.",
+				stdhttp.StatusUnprocessableEntity)
+			return
+		}
 	}
 
 	if !s.deps.Hub.Connected(host.ID) {
@@ -210,13 +217,12 @@ func (s *Server) handleUIRestorePost(w stdhttp.ResponseWriter, r *stdhttp.Reques
 	}
 
 	// Build a new job id up-front so we can substitute it into the
-	// new-directory target path. The dispatch helper will use this
-	// same id (mint=now → reuse via dispatchJobWithPayload's
-	// signature requires the id, so do it here and pass on).
+	// new-directory target path. The agent will additionally expand
+	// $HOME / ~/ before invoking restic.
 	jobID := ulid.Make().String()
 	finalTarget := ""
 	if !inPlace {
-		finalTarget = path.Join(defaultRestoreTargetRoot(), jobID)
+		finalTarget = strings.ReplaceAll(targetDir, "<job-id>", jobID)
 	}
 
 	now := time.Now().UTC()
@@ -383,22 +389,37 @@ func (s *Server) handleUIRestoreTree(w stdhttp.ResponseWriter, r *stdhttp.Reques
 	}
 }
 
-// defaultRestoreTargetRoot is the parent of the per-job restore
-// directory. The agent's systemd unit pins ReadWritePaths to
-// /etc/restic-manager + /var/lib/restic-manager (with ProtectSystem=
-// strict making the rest of /var read-only); restore writes have to
-// land inside one of those, so we keep them under
-// /var/lib/restic-manager/restore where the agent is already allowed
-// to write. The /restore subdir is created by the agent on demand.
-func defaultRestoreTargetRoot() string {
-	return "/var/lib/restic-manager/restore"
+// defaultRestoreTargetDir is the placeholder shown on the step-3
+// New-directory radio card and the value used when the operator
+// leaves the field blank. $HOME resolves agent-side (typically /root
+// for the systemd-as-root unit); <job-id> is substituted at dispatch.
+// The systemd unit pins ReadWritePaths to include the agent user's
+// home/rm-restore subdir so this default actually works under the
+// sandbox.
+func defaultRestoreTargetDir() string {
+	return "$HOME/rm-restore/<job-id>/"
 }
 
-// defaultRestoreTargetDir surfaces the placeholder path shown on the
-// step-3 New-directory radio card. The "<job-id>" is not substituted
-// here — that happens at dispatch time.
-func defaultRestoreTargetDir() string {
-	return defaultRestoreTargetRoot() + "/<job-id>/"
+// looksLikeRestoreTarget validates the operator-supplied target dir
+// is a shape the agent can sensibly resolve. We accept absolute
+// paths and a couple of agent-side expansions ($HOME, ~/). Other env
+// vars are deliberately rejected — operator-supplied paths shouldn't
+// be able to pick up arbitrary agent env values.
+func looksLikeRestoreTarget(p string) bool {
+	if p == "" {
+		return false
+	}
+	switch {
+	case strings.HasPrefix(p, "/"):
+		return true
+	case strings.HasPrefix(p, "$HOME/"), p == "$HOME":
+		return true
+	case strings.HasPrefix(p, "${HOME}/"), p == "${HOME}":
+		return true
+	case strings.HasPrefix(p, "~/"), p == "~":
+		return true
+	}
+	return false
 }
 
 // sessionIDFromCookie returns the operator's session cookie value,