v0.105.0: fork-4 offsite password custody — hand-off + atomicity gate + DR inject + coord

Pairs with agent v0.77.0. StageEscrowSecret pushes the repo password to the
agent (POST /escrow/stage-secret) at offsite-enable → EscrowState="pending".
Atomicity gate: RunOffboxBackup (scheduler + handler) refuses until
EscrowState="escrowed" (operator POST /backup/offbox/confirm-escrow after the
escrow ceremony) — no un-recoverable offsite ciphertext can exist. DR:
POST /backup/offbox/inject-password pre-places a recovered 64-hex password 0600
(honored by WriteOffboxSecrets' IsNotExist guard; refuses clobber without
force). DR recipe gains non-secret offsite_restic coords (DRResticCoord); SFTP
key regenerated at DR, not escrowed. New settings.OffboxTarget.EscrowState.
Tests + atomicity & inject companion red-proofs green; UI gates pass. NOT yet
live-validated (supervised ceremony).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/settings/settings.go

@@ -129,6 +129,11 @@ type OffboxTarget struct {
 	// LastWarning is a customer-visible notice set on an otherwise-OK run when SOME toggled apps had
 	// no discoverable recovery unit (partial run). Empty on a fully-successful or failed run.
 	LastWarning string `json:"last_warning,omitempty"`
+	// EscrowState (fork-4) gates offsite RUNS on the repo password being escrowed under R: ""|"pending"
+	// |"escrowed". Enabling offsite stages the password to the agent and sets "pending"; no offsite run
+	// proceeds until an operator confirms the escrow ceremony ("escrowed") — so no un-recoverable
+	// offsite ciphertext can exist. It is NOT a secret (a state label); the password never lives here.
+	EscrowState string `json:"escrow_state,omitempty"`
 }
 
 // CrossDriveBackup configures per-app backup to a secondary drive.