backup classification: backup: blocks for the 13 bind-bearing apps

Adds the referential-coupling backup: block to every app that binds
${HDD_PATH}/${USERDATA_PATH} (immich, paperless-ngx, nextcloud, calibre-web,
audiobookshelf, komga, navidrome, radarr, sonarr, emby, jellyfin, plex, romm).
Each lists its userdata:/hdd: binds with class mandatory|optional|excluded
(operator-ruled + spike SQ2).

Requires controller v0.132.0 (deployed) which parses+validates these blocks.
INERT — no backup tier changes behavior yet (Task 3/4 consume it). All 13
verified against the shipped parser: parse-clean, every bind resolves explicit.
audiobookshelf media/audiobooks = optional (PENDING Viktor veto to excluded).

Ref: felhom.eu/documentation/audits/SPIKE-backup-classification-2026-07-14.md

templates/navidrome/.felhom.yml

@@ -16,6 +16,12 @@ resources:
   pi_compatible: true
   needs_hdd: true
 
+# --- Backup classification (referential coupling; see felhom.eu documentation/audits/SPIKE-backup-classification-2026-07-14.md) ---
+backup:
+  userdata:
+    - path: media/music
+      class: excluded          # re-rippable bulk, :ro, shared tree
+
 # --- Deploy fields (first deployment only) ---
 deploy_fields:
   - env_var: DOMAIN