restore: invert gate to NO_SLOWDISK (default true) + add --no-slowdisk override flag

Static-file offload gating, clearer semantics:
- NO_SLOWDISK defaults to TRUE (offload OFF) — safe default everywhere.
- A host with a real dedicated extra disk at /slowdisk sets NO_SLOWDISK=false in its .env
  to ENABLE the offload.
- New --no-slowdisk CLI flag forces NO_SLOWDISK=true, overriding the .env false — for when
  the extra disk exists but is full. Flag is parsed position-independently; the positional
  args ($1 compose, $2 remote source) are preserved.

Offload runs only when NO_SLOWDISK is false AND the flag was not passed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

restore-volumes.sh

@@ -1,10 +1,26 @@
 #!/bin/bash
 dir="$(dirname "$0")"
 source "$dir/volume-utils.sh"
-# Host config: SLOWDISK gates the static-file offload (see prep_static_offload). It must be
-# set ONLY on hosts that have a real dedicated extra disk mounted at /slowdisk; on hosts
-# where /slowdisk is just a folder on the root disk, offloading gives no benefit.
+
+# Pull out the --no-slowdisk flag (position-independent); keep the positional args
+# ($1 = compose name, $2 = optional remote source) intact for the rest of the script.
+no_slowdisk_flag=0
+_pos=()
+for _a in "$@"; do
+    case "$_a" in
+        --no-slowdisk) no_slowdisk_flag=1 ;;
+        *) _pos+=("$_a") ;;
+    esac
+done
+set -- "${_pos[@]}"
+
+# Static-file offload gate. NO_SLOWDISK defaults to TRUE (offload OFF). A host with a real
+# dedicated extra disk mounted at /slowdisk sets NO_SLOWDISK=false in its .env to ENABLE the
+# offload. The --no-slowdisk flag forces it back to true (e.g. the extra disk is full),
+# overriding the .env value.
 [ -f "$dir/.env" ] && source "$dir/.env"
+NO_SLOWDISK="${NO_SLOWDISK:-true}"
+[ "$no_slowdisk_flag" = 1 ] && NO_SLOWDISK=true
 
 remote_source="$2"
 if [[ -n "$remote_source" ]] && is_local_backup_url "$remote_source"; then
@@ -28,12 +44,16 @@ fi
 # hot/dynamic state stays on the primary disk. tar then extracts THROUGH the symlinks via
 # --keep-directory-symlink (it keeps the dir-symlinks instead of clobbering them).
 # Target naming matches delete-volumes.sh / delete_slowdisk_targets_for_key cleanup.
-# GATED on the SLOWDISK env var from .env: only hosts with a real dedicated extra disk set
-# it. Safe fallbacks (just extract normally): SLOWDISK unset, /slowdisk missing, no manifest,
-# or no static paths. (/slowdisk is the fixed in-container mount, so the target path is fixed.)
+# GATED on NO_SLOWDISK (see top): offload runs only when NO_SLOWDISK=false (host has a real
+# dedicated extra disk; set in .env) and the --no-slowdisk flag was not passed. Safe fallbacks
+# (just extract normally): NO_SLOWDISK true, /slowdisk missing, no manifest, or no static paths.
+# (/slowdisk is the fixed in-container mount, so the target path is fixed.)
 prep_static_offload() {
     local key=$1 meta=$2 data_dir=$3 rel target
-    [ -n "${SLOWDISK:-}" ] || { echo "  SLOWDISK not set in .env (no dedicated extra disk) — no static offload"; return 0; }
+    case "${NO_SLOWDISK,,}" in
+        false|0|no|off) ;;  # offload enabled
+        *) echo "  static offload disabled (NO_SLOWDISK=$NO_SLOWDISK) — normal extract"; return 0 ;;
+    esac
     [ -d /slowdisk ] || { echo "  /slowdisk absent — no static offload"; return 0; }
     [ -f "$meta" ]   || { echo "  no manifest ($meta) — no static offload"; return 0; }
     # manifest data lines (after the 3-line header) are "<size>  <relpath>"