P3 follow-up: editable target dir, conditional --no-ownership, UK lint

Three small follow-ups from review:

1. Restore target is now operator-editable. Default value is the
   literal '\$HOME/rm-restore/<job-id>/' (agent expands \$HOME at
   run time using os.UserHomeDir(); also handles \${HOME} and ~/
   prefixes). Operator can replace with any absolute path.
   - ui_restore.go validates the input is either absolute or starts
     with one of the recognised prefixes; other env-var refs (\$PATH
     etc.) are deliberately rejected so operator paths can't pick up
     arbitrary agent env values.
   - host_restore.html replaces the read-only mono-text display with
     a real <input>; help text spells out that \$HOME resolves
     agent-side and <job-id> is substituted on dispatch.
   - install.sh + the systemd unit prep /root/rm-restore so the
     default works under the sandbox: ReadWritePaths gains a soft
     '-/root/rm-restore' entry (the '-' makes the bind-mount soft-fail
     if missing, but install.sh pre-creates it root-owned 0700).

2. --no-ownership flag now gated on restic version. The flag was
   added in restic 0.17 and 0.16 rejects it. Previously dropped it
   wholesale — that meant new-dir restores silently preserved
   ownership against design intent on 0.17+. Now the agent threads
   its detected restic version (sysinfo already collects it) through
   runner.Config -> restic.Env, and RunRestore appends --no-ownership
   only when AtLeastVersion(0, 17) returns true. 0.16 hosts still
   restore with original uid/gid; help text in the wizard explicitly
   notes this. The previous 'Original ownership is preserved' copy
   was wrong for new-dir mode and is corrected.

3. golangci-lint misspell locale switched US -> UK and the codebase
   swept (73 corrections, mostly behaviour/serialise/recognise/honour).
   Wire-format ErrorCode 'unauthorized' -> 'unauthorised' is a tiny
   contract change but the agent doesn't parse those codes today and
   no external API consumers exist yet. Tests passed before + after.

Tests:
- internal/restic/version_test.go covers Env.AtLeastVersion across
  edge cases (empty, exact match, patch above, minor below, non-
  numeric) and expandHome on \$HOME / \${HOME} / ~/, plus
  pass-through for absolute paths and refusal of other env vars.
- ui_restore_test updated: TargetDir now starts '\$HOME/rm-restore/'
  with the job_id substituted into the placeholder.

Live verified on the smoke env: default target restored to
/root/rm-restore/<job-id>/ as the agent's expanded \$HOME (2 files,
14 bytes); custom override '/tmp/custom-restore/<job-id>/' restored
into the agent's PrivateTmp namespace (1 file, 6 bytes); both jobs
'succeeded', exit 0.

cmd/agent/main.go

@@ -136,6 +136,7 @@ func run() error {
 
 	d := &dispatcher{
 		resticBin: resticBin,
+		resticVer: snap.ResticVersion,
 		secrets:   sec,
 		scheduler: scheduler.New(),
 	}
@@ -200,6 +201,7 @@ func openSecretsStore(cfg *config.Config) (*secrets.Store, error) {
 // so a job dispatched in the same session sees the latest values.
 type dispatcher struct {
 	resticBin string
+	resticVer string // e.g. "0.17.1"; empty if restic isn't installed yet
 	secrets   *secrets.Store
 	scheduler *scheduler.Scheduler
 
@@ -276,7 +278,7 @@ func (d *dispatcher) handle(ctx context.Context, env api.Envelope, tx wsclient.S
 
 	case api.MsgTreeList:
 		// Synchronous RPC for the restore wizard's tree browser. The
-		// server has serialized access; we just run restic ls and reply
+		// server has serialised access; we just run restic ls and reply
 		// with the same envelope ID. Run in a goroutine so the WS read
 		// loop keeps draining.
 		var p api.TreeListRequestPayload
@@ -493,6 +495,7 @@ func (d *dispatcher) runJob(ctx context.Context, p api.CommandRunPayload, tx wsc
 
 	r := runner.New(runner.Config{
 		ResticBin:         d.resticBin,
+		ResticVersion:     d.resticVer,
 		RepoURL:           creds.URL,
 		RepoUsername:      creds.Username,
 		RepoPassword:      creds.Password,
@@ -588,6 +591,7 @@ func (d *dispatcher) runJob(ctx context.Context, p api.CommandRunPayload, tx wsc
 		}
 		prr := runner.New(runner.Config{
 			ResticBin:         d.resticBin,
+			ResticVersion:     d.resticVer,
 			RepoURL:           runCreds.URL,
 			RepoUsername:      runCreds.Username,
 			RepoPassword:      runCreds.Password,