v0.12.5: drive-type-aware cross-drive backup validation

Fix cross-drive backup failing for system-drive destinations. The
/mnt/hdd_placeholder folder is on the internal SSD, so IsMountPoint()
returned false and the old code hard-blocked it.

- ValidateDestination() (crossdrive.go): onSystemDrive flag replaces
  boolean-only check; system drives require ≥10 GB free and <90% usage
  to protect OS stability; external drives just need ≥100 MB free.
- CheckBackupDestination() (mounts_linux.go): Tier 4 now branches on
  h.SystemDrive; system drive blocks at <10 GB free or ≥90% usage
  (matches runner enforcement); external drive unchanged (warn 90%,
  block 95%). Removes the && h.Severity == "ok" guard that was
  preventing system-drive critical messages from overriding warnings.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

controller/README.md

@@ -4,7 +4,7 @@
 
 A single, lightweight Go container that replaces Portainer + scattered systemd scripts with a unified, Hungarian-language web dashboard for managing Docker Compose stacks, backups, storage, monitoring, and notifications on customer hardware.
 
-**Current version: v0.12.2**
+**Current version: v0.12.5**
 
 ---
 
@@ -192,7 +192,11 @@ Implements the 3-2-1 backup rule by copying data to a different physical drive.
   - **rsync** — Simple mirror with `--delete` (fast, no versioning)
   - **restic** — Versioned, deduplicated, encrypted (shared repo across apps)
 - Per-app configuration: destination path, method, schedule (daily/weekly/manual)
-- Safety guards: destination != source, mount point check, writable check
+- **Drive-type-aware validation** (`ValidateDestination` / `CheckBackupDestination`):
+  - External mount: block if <100 MB free; warn/block at 90%/95% usage
+  - System drive (same block device as `/`): require ≥10 GB free AND <90% usage to protect OS stability; allowed with a logged warning (no hard block for non-mount-point destinations)
+  - Web UI `CheckBackupDestination` matches runner thresholds — no surprise divergence between UI and actual enforcement
+- Safety guards: destination ≠ source, path-overlap check, writable check
 - **Chained execution**: cross-drive runs immediately after nightly restic backup (daily apps every night, weekly apps on Sundays) for DB/file consistency
 - Per-app concurrency lock prevents overlapping runs
 - Status tracking (last_run, duration, size, error) persisted to settings.json