v0.99.0 — R-82 operator rulings: 2-week offsite retention + one backup at a time

Ruling 1 (2 weeks of weekly offsite backups): localPruneSpec's blanket PBS
refusal is now scoped — an ADDITIONAL tier with an explicit keep_last may
prune its PBS target. The refusal still applies in full to the PRIMARY tier,
because BackupTarget() defaults to felhom-pbs and KeepLast() defaults to 3, so
a box with neither key set would silently prune its offsite DR to 3 restore
points. An additional tier cannot have that accident (keep_last defaults to 0).

Ruling 3 (first backup runs as long as needed; nothing else starts until done):
- additional-tier wait bound 6h -> 12h (measured ~33 MB/min => ~5h for a first
  full 10 GB snapshot; 12h gives margin but stays bounded so a hung task still
  surfaces)
- ONE BACKUP AT A TIME PER GUEST across all tiers: POST /backup returns 409
  when a DIFFERENT tier is in flight, naming the busy tier, with NO data object
  so nothing is parseable as the caller's own job. Same tier still returns that
  job (202, unchanged).
- snapshotted now counts as in-flight, not just running — after the snapshot the
  vzdump is still uploading and holding the lock. The old check left a window
  where a second POST started a real second vzdump. Latent bug, closed.

Full suite green (29 packages); red-proof observed and restored.

internal/config/backup_tiers_test.go

@@ -166,8 +166,8 @@ func TestBackupTiers_WaitTimeoutIsPerTier(t *testing.T) {
 	if tiers[0].WaitTimeout != 30*time.Minute {
 		t.Fatalf("the PRIMARY must keep the historical 30m wait (unchanged behaviour); got %s", tiers[0].WaitTimeout)
 	}
-	if tiers[1].WaitTimeout != 6*time.Hour {
-		t.Fatalf("an offsite tier must default to a GENEROUS wait — a false timeout is worse than a slow pass; got %s", tiers[1].WaitTimeout)
+	if tiers[1].WaitTimeout != 12*time.Hour {
+		t.Fatalf("an offsite tier must default to a GENEROUS wait (operator ruling: let the first backup run as long as needed) — a false timeout is worse than a slow pass; got %s", tiers[1].WaitTimeout)
 	}
 	// And it must be overridable per tier.
 	b.ExtraTargets[0].WaitTimeoutSeconds = 3600

internal/config/config.go

@@ -413,12 +413,13 @@ type BackupTargetConfig struct {
 // and one hanging 30 minutes is a genuine fault worth surfacing. Unchanged behaviour.
 //
 // An ADDITIONAL tier is by construction the offsite/WAN one in this design, where the binding
-// constraint is uplink speed, not health. 6h covers a first FULL snapshot of a ~10 GB guest at the
-// ~30 Mbit/s measured on demo-felhom (that first backup alone projects to ~5.5h); later
-// incrementals are far quicker. Sized from the measurement, not guessed.
+// constraint is uplink speed, not health. Measured on demo-felhom: ~33 MB/min over the wg link to
+// Hetzner, so a first FULL ~10 GB snapshot projects to ~5h. Operator ruling 2026-07-26: "let the
+// first backup run as long as needed" — 12h gives that real margin on a slower link while still
+// being BOUNDED, so a genuinely hung task eventually surfaces instead of hanging forever.
 const (
 	defaultPrimaryTierWaitTimeout = 30 * time.Minute
-	defaultExtraTierWaitTimeout   = 6 * time.Hour
+	defaultExtraTierWaitTimeout   = 12 * time.Hour
 )
 
 // BackupTier is a RESOLVED backup tier: one target, its own cadence, its own retention. The agent