v0.317.0: a second copy counts only on a proven different disk; the no-drive install speaks in words (felhom.eu architecture/16, build A)

Tier-2 and the one-copy notice ask the host agent (POST /disks/same-disk, agent 0.157.0): different +
proven -> made and counted; same disk -> not made (D1); unknown (VM, hidden USB serial) -> made, not
counted, the row says why (D2); a NAS never counts and no longer hides the notice (R-1075). An older
agent keeps the st_dev rule, logged once. D4: a data-folder or media app on a box with no drive is
refused in words with a link to the drives page (R-1068's raw-error half). MinAgent 0.157.0.

Claude-Session: https://claude.ai/code/session_012qRErfCoiTkvDK9N5XHbzb

controller/internal/settings/settings.go

@@ -550,6 +550,10 @@ type CrossDriveBackup struct {
 	// destination drive (a registered storage Path) instead of the auto-pick ("" = auto).
 	UserDisabled    bool   `json:"user_disabled,omitempty"`
 	PreferredTarget string `json:"preferred_target,omitempty"`
+	// Unproven (v0.317.0, `16` D2): the last copy sits on a drive the host agent cannot prove is another
+	// physical disk (a VM, a hidden USB serial). It was made; it does not count as a second copy.
+	Unproven       bool   `json:"unproven,omitempty"`
+	UnprovenReason string `json:"unproven_reason,omitempty"`
 }
 
 // Storage path kinds. A DRIVE is a physical disk with the full enroll/eject/decommission/migrate/wipe