Offsite tier policy engine: mandatory userdata, raw-data quota, restore rework (Task 3a, v0.134.0)

Each toggled app's offsite push = one multi-path restic snapshot (recovery unit + TierOffsite
mandatory userdata via ComputeCaptureSet); legacy/undeployed stay unit-only. Loud capture gaps
(SP-3.4: restic 0.14.0 silently skips missing paths). Quota = stats --mode raw-data (SP-1;
displayed size drops once). Pre-push enlargement gate blocks the userdata enlargement over-quota
(unit-only push continues; EnlargedBlocked; edge-triggered notify). forget --group-by host,tags
on both sites (SP-2). Restore reworked: scratch off the rootfs + headroom gate (F-A1), unit-only
default via --include, size-first full, place-to-live missing-only merge (never --delete).
UI: unit/full-two-step/place actions + per-app blocked note; route POST /backup/offbox/place.
HUB FLAG: offbox_enlarge_blocked event needs hub allowlist for push delivery.
+13 tests; all 10 §10 red-proofs verified. No tier-2/.fab/hub/agent changes.

controller/internal/settings/settings.go

@@ -147,6 +147,11 @@ type OffboxTarget struct {
 	// LastWarning is a customer-visible notice set on an otherwise-OK run when SOME toggled apps had
 	// no discoverable recovery unit (partial run). Empty on a fully-successful or failed run.
 	LastWarning string `json:"last_warning,omitempty"`
+	// EnlargedBlocked (3a) lists the apps whose ENLARGED (mandatory-userdata) offsite push was refused
+	// by the pre-push quota gate on the last run — their unit-only push still succeeded. Replaced each
+	// OK run (sorted; empty clears). Drives the per-app "config+DB only" note on /backups/remote and
+	// the edge-triggered enlarge-blocked notification. Not a secret (app-name list).
+	EnlargedBlocked []string `json:"enlarged_blocked,omitempty"`
 	// EscrowState (fork-4) gates offsite RUNS on the repo password being escrowed under R: ""|"pending"
 	// |"escrowed". Enabling offsite stages the password to the agent and sets "pending"; no offsite run
 	// proceeds until an operator confirms the escrow ceremony ("escrowed") — so no un-recoverable