Offsite tier policy engine: mandatory userdata, raw-data quota, restore rework (Task 3a, v0.134.0)

Each toggled app's offsite push = one multi-path restic snapshot (recovery unit + TierOffsite
mandatory userdata via ComputeCaptureSet); legacy/undeployed stay unit-only. Loud capture gaps
(SP-3.4: restic 0.14.0 silently skips missing paths). Quota = stats --mode raw-data (SP-1;
displayed size drops once). Pre-push enlargement gate blocks the userdata enlargement over-quota
(unit-only push continues; EnlargedBlocked; edge-triggered notify). forget --group-by host,tags
on both sites (SP-2). Restore reworked: scratch off the rootfs + headroom gate (F-A1), unit-only
default via --include, size-first full, place-to-live missing-only merge (never --delete).
UI: unit/full-two-step/place actions + per-app blocked note; route POST /backup/offbox/place.
HUB FLAG: offbox_enlarge_blocked event needs hub allowlist for push delivery.
+13 tests; all 10 §10 red-proofs verified. No tier-2/.fab/hub/agent changes.

controller/internal/notify/notifier.go

@@ -286,6 +286,15 @@ func (n *Notifier) NotifyBackupFailed(message, errMsg string) {
 	n.PushEvent("backup_failed", "error", message, BackupDetails{Error: errMsg})
 }
 
+// NotifyOffboxEnlargeBlocked sends a WARNING (not a failure) when an app's enlarged offsite push was
+// refused by the pre-push quota gate — its config+DB were still saved. Customer-facing (Hungarian
+// body). NOTE: the event type "offbox_enlarge_blocked" must be added to the hub's allowedEventTypes +
+// customerMessages for delivery (a hub-side task, flagged — until then the hub 400s/drops it and the
+// in-dashboard LastWarning + /backups/remote note carry the message).
+func (n *Notifier) NotifyOffboxEnlargeBlocked(message string) {
+	n.PushEvent("offbox_enlarge_blocked", "warning", message, nil)
+}
+
 // (NotifyBackupCompleted removed 2026-06-16 — the backup_completed event had no callers
 // since slice 8C moved whole-guest backup to the agent. The hub's backup-deadline check
 // now reads the agent host-report's PBS snapshots instead of this event. DB-dump events