R-729 + R-545: the household can remove its own off-site target („Távoli mentési cél törlése")

POST /backup/offbox/clear (reveal-then-confirm) forgets the target and deletes ssh_key + known_hosts;
nothing on the target is touched. repo_password is kept whenever anything could depend on it (hub
sealed package — the R-241 rule; escrowed; a successful run; snapshots) and deleted only otherwise.
Refused for the Felhom tier (rclone-pinned), while the single-flight is held, and while an
abandonment countdown runs. i18n parity fixtures of backups_remote gain the additive block only.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/server.go

@@ -753,6 +753,8 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		s.offboxRunHandler(w, r)
 	case path == "/backup/offbox/reset" && r.Method == http.MethodPost:
 		s.offboxResetHandler(w, r)
+	case path == "/backup/offbox/clear" && r.Method == http.MethodPost: // R-729 / R-545
+		s.offboxClearHandler(w, r)
 	case path == "/backup/offbox/status" && r.Method == http.MethodGet:
 		s.offboxStatusHandler(w, r)
 	case path == "/backup/offbox/restore" && r.Method == http.MethodPost: