fix(e12): the restart hint pointed at the one command that undoes a rollback

Round three, on round two's diff. The trend across the loop is 47 -> 34 -> 15 raw
findings; the ops half kept producing the sharpest ones because the gate cannot run it.

**`docker compose start` ignores a newly pinned IMAGE_TAG.** Round two removed the
automatic restart because it re-ran `alembic upgrade head` — and then told the operator to
run that exact command by hand, in both scripts and the docs. `start` relaunches the
container that already exists, which still carries the tag being rolled back FROM, so
pinning 0.79.0 and following the printed instruction brings 0.80.0 back up and re-applies
its migrations. Verified against a real daemon: after changing the pinned tag, `start` kept
the old image and only `up -d` picked up the new one. Both scripts and the doc now say
`up -d`, with the pin-first caveat where the operator reads it.

**The reset flag outlived its token.** Reverting round one's "each link clears the other"
went one step too far: a `#verify=` link pasted over a standing reset notice replaces the
whole fragment, so the reset token is gone — but `resetPending` stayed true, and being
checked first it hid the confirmation while promising a recovery that signing out could no
longer complete. The flag is now cleared when the fragment it describes is gone, which is
narrower than what was reverted and does not blank the signed-out card.

**A test that could not fail.** The shared-asset regression test seeded the asset as
`pending`, and `_reset_asset_pending` only acts on `downloading` — so the release half was a
no-op and deleting it kept the suite green. Seeded as the worker actually leaves it now.

Also: the malformed-URL guard answers with urlguard's structured detail rather than a bare
English string, so both halves of one typo class get the same localized copy, and the third
site in that module handing user input to `urlparse` was swept with it; the asset is
released after the job is terminal, not before; the Stats 403 toast gets the wizard handle
its own comment claimed it had; the pasted Windows recipe sets `$ErrorActionPreference`
inside the block (a scriptblock inherits the caller's, so a `SilentlyContinue` profile
swallowed every throw) and cleans up the container-side dump on the failure path too; the
restore warning moved to the warning stream so a `> log` redirect cannot file it away; and
two comments narrowed to what the code does.

Gate green: vitest 685, pytest 950.

docs/self-hosting.md

@@ -194,9 +194,10 @@ docker compose -f docker-compose.selfhost.yml exec -T db \
   pg_restore -U siftlode -d siftlode --clean --if-exists < backups/siftlode-<timestamp>.dump
 
 # Start it again only once the restore reported no errors — and, if you are rolling a release back,
-# only AFTER pinning the older IMAGE_TAG. Every start runs `alembic upgrade head`, so starting the
-# newer image here would re-apply the migrations you just restored away.
-docker compose -f docker-compose.selfhost.yml start api worker
+# only AFTER pinning the older IMAGE_TAG. Every start runs `alembic upgrade head`, so bringing the
+# newer image back here would re-apply the migrations you just restored away. Use `up -d`, not
+# `start`: `start` relaunches the container that already exists, which still carries the old tag.
+docker compose -f docker-compose.selfhost.yml up -d
 ```
 
 On Windows, do **not** pipe the dump through PowerShell — it corrupts binary data. Write it inside the
@@ -209,12 +210,17 @@ copy would still run after a failed dump — and copy out the previous run's fil
 
 ```powershell
 & {
+  # Inside the block, because a scriptblock inherits the caller's preference — under a profile that
+  # sets SilentlyContinue, every `throw` below would be swallowed and the block would run on.
+  $ErrorActionPreference = "Stop"
   $compose = "docker-compose.selfhost.yml"
   New-Item -ItemType Directory -Force -Path backups | Out-Null
   $out = "backups\siftlode-$(Get-Date -Format yyyyMMdd-HHmmss).dump"
   docker compose -f $compose exec -T db pg_dump -U siftlode -Fc siftlode -f /tmp/s.dump
   $code = $LASTEXITCODE
-  if ($code -ne 0) { throw "BACKUP FAILED - pg_dump returned $code" }
+  # Remove the in-container dump on the failure path too: leaving it there is how a LATER failed run
+  # copies out this run's file and overwrites a good backup with a stale one.
+  if ($code -ne 0) { docker compose -f $compose exec -T db rm -f /tmp/s.dump; throw "BACKUP FAILED - pg_dump returned $code" }
   docker compose -f $compose cp db:/tmp/s.dump $out
   $code = $LASTEXITCODE
   docker compose -f $compose exec -T db rm -f /tmp/s.dump