fix(e12): the restart hint pointed at the one command that undoes a rollback

Round three, on round two's diff. The trend across the loop is 47 -> 34 -> 15 raw
findings; the ops half kept producing the sharpest ones because the gate cannot run it.

**`docker compose start` ignores a newly pinned IMAGE_TAG.** Round two removed the
automatic restart because it re-ran `alembic upgrade head` — and then told the operator to
run that exact command by hand, in both scripts and the docs. `start` relaunches the
container that already exists, which still carries the tag being rolled back FROM, so
pinning 0.79.0 and following the printed instruction brings 0.80.0 back up and re-applies
its migrations. Verified against a real daemon: after changing the pinned tag, `start` kept
the old image and only `up -d` picked up the new one. Both scripts and the doc now say
`up -d`, with the pin-first caveat where the operator reads it.

**The reset flag outlived its token.** Reverting round one's "each link clears the other"
went one step too far: a `#verify=` link pasted over a standing reset notice replaces the
whole fragment, so the reset token is gone — but `resetPending` stayed true, and being
checked first it hid the confirmation while promising a recovery that signing out could no
longer complete. The flag is now cleared when the fragment it describes is gone, which is
narrower than what was reverted and does not blank the signed-out card.

**A test that could not fail.** The shared-asset regression test seeded the asset as
`pending`, and `_reset_asset_pending` only acts on `downloading` — so the release half was a
no-op and deleting it kept the suite green. Seeded as the worker actually leaves it now.

Also: the malformed-URL guard answers with urlguard's structured detail rather than a bare
English string, so both halves of one typo class get the same localized copy, and the third
site in that module handing user input to `urlparse` was swept with it; the asset is
released after the job is terminal, not before; the Stats 403 toast gets the wizard handle
its own comment claimed it had; the pasted Windows recipe sets `$ErrorActionPreference`
inside the block (a scriptblock inherits the caller's, so a `SilentlyContinue` profile
swallowed every throw) and cleans up the container-side dump on the failure path too; the
restore warning moved to the warning stream so a `> log` redirect cannot file it away; and
two comments narrowed to what the code does.

Gate green: vitest 685, pytest 950.

backend/tests/test_download_limits.py

@@ -251,8 +251,15 @@ def test_a_refusal_for_one_user_does_not_poison_the_shared_asset(db, monkeypatch
     full = _sized_asset(db, 1500, "already-held")
     _job(db, over.id, queue_pos=0, status="done", asset_id=full.id)
 
+    # `downloading` is the state the worker leaves it in — `_claim_asset` compare-and-sets it before
+    # the child runs — and `_reset_asset_pending` only acts on that status. Seeded as `pending` this
+    # assertion would pass with the release deleted.
     shared = MediaAsset(
-        source_kind="youtube", source_ref="x" * 11, format_sig="s", status="pending", ref_count=2
+        source_kind="youtube",
+        source_ref="x" * 11,
+        format_sig="s",
+        status="downloading",
+        ref_count=2,
     )
     db.add(shared)
     db.flush()