backup classification: backup: blocks for the 13 bind-bearing apps

Adds the referential-coupling backup: block to every app that binds
${HDD_PATH}/${USERDATA_PATH} (immich, paperless-ngx, nextcloud, calibre-web,
audiobookshelf, komga, navidrome, radarr, sonarr, emby, jellyfin, plex, romm).
Each lists its userdata:/hdd: binds with class mandatory|optional|excluded
(operator-ruled + spike SQ2).

Requires controller v0.132.0 (deployed) which parses+validates these blocks.
INERT — no backup tier changes behavior yet (Task 3/4 consume it). All 13
verified against the shipped parser: parse-clean, every bind resolves explicit.
audiobookshelf media/audiobooks = optional (PENDING Viktor veto to excluded).

Ref: felhom.eu/documentation/audits/SPIKE-backup-classification-2026-07-14.md

templates/immich/.felhom.yml

@@ -21,6 +21,15 @@ resources:
   pi_compatible: false
   needs_hdd: true
 
+# --- Backup classification (referential coupling; see felhom.eu documentation/audits/SPIKE-backup-classification-2026-07-14.md) ---
+backup:
+  hdd:
+    - path: appdata/immich
+      class: mandatory        # managed upload library — DB-referenced (SQ3: restore-without = broken)
+  userdata:
+    - path: media/photos
+      class: optional          # external library, :ro — precious but re-scanned (explicit overrides ro-default)
+
 # --- Deploy fields ---
 deploy_fields:
   - env_var: DOMAIN