Fix four audit findings; simplify apply.sh boolean gate

- uninstall.sh: track _restore_failed separately from RESTORED so
  "No backup files found" only prints when find returns nothing (not
  when mv fails on existing backups); abort with exit 1 before rm -rf
  when any restore fails, leaving PATCH_DIR and recover.sh intact
- install.sh: extend log-scan grep to catch ERROR: lines from
  patch_ui.py (backup OSError was silently missed by WARNING:-only grep)
- install.sh: reword restart-failure message — hook IS already
  registered and sitecustomize.py IS installed; patch activates on
  next boot regardless
- apply.sh: replace `if $_can_install` with `[ "$_can_install" = true ]`
  (explicit test, no implicit command lookup); drop 2>/dev/null on
  install cp so OS error detail reaches the log

uninstall.sh

@@ -102,6 +102,7 @@ echo ""
 echo "Restoring UI bundle backup ..."
 
 RESTORED=0
+_restore_failed=0
 while IFS= read -r backup; do
     original="${backup%.pre-truecloud-patch}"
     if mv "$backup" "$original"; then
@@ -109,11 +110,20 @@ while IFS= read -r backup; do
         RESTORED=1
     else
         echo "  WARNING: Could not restore $original — backup left at $backup"
+        _restore_failed=1
     fi
 # Keep these paths in sync with WEBUI_CANDIDATES in patch/patch_ui.py
 done < <(find /usr/share/truenas /usr/share/truenas-ui /var/www/truenas \
               -name "*.js.pre-truecloud-patch" 2>/dev/null)
 
+if [ "$_restore_failed" -eq 1 ]; then
+    echo ""
+    echo "ERROR: One or more UI bundle backups could not be restored." >&2
+    echo "  $PATCH_DIR has been left intact (recover.sh and patch files are safe)." >&2
+    echo "  Restore the backup(s) manually, then re-run uninstall.sh." >&2
+    exit 1
+fi
+
 if [ "$RESTORED" -eq 0 ]; then
     echo "  No backup files found."
     echo "  The UI patch will be undone automatically by the next TrueNAS update."