backup classification: backup: blocks for the 13 bind-bearing apps

Adds the referential-coupling backup: block to every app that binds
${HDD_PATH}/${USERDATA_PATH} (immich, paperless-ngx, nextcloud, calibre-web,
audiobookshelf, komga, navidrome, radarr, sonarr, emby, jellyfin, plex, romm).
Each lists its userdata:/hdd: binds with class mandatory|optional|excluded
(operator-ruled + spike SQ2).

Requires controller v0.132.0 (deployed) which parses+validates these blocks.
INERT — no backup tier changes behavior yet (Task 3/4 consume it). All 13
verified against the shipped parser: parse-clean, every bind resolves explicit.
audiobookshelf media/audiobooks = optional (PENDING Viktor veto to excluded).

Ref: felhom.eu/documentation/audits/SPIKE-backup-classification-2026-07-14.md

templates/paperless-ngx/.felhom.yml

@@ -32,6 +32,17 @@ resources:
   pi_compatible: true                  # Runs on Raspberry Pi 3B+
   needs_hdd: true                      # Needs external storage for user data
 
+# --- Backup classification (referential coupling; see felhom.eu documentation/audits/SPIKE-backup-classification-2026-07-14.md) ---
+backup:
+  hdd:
+    - path: appdata/paperless/media
+      class: mandatory        # document originals+archive — DB hashes/paths reference them
+    - path: appdata/paperless/export
+      class: excluded          # transient export target
+  userdata:
+    - path: import/paperless
+      class: excluded          # consume inbox — deleted after ingest by contract
+
 # --- Deploy fields ---
 # Shown to the user during first deployment.
 # After deployment, values are saved to app.yaml in the stack directory.