Offsite tier policy engine: mandatory userdata, raw-data quota, restore rework (Task 3a, v0.134.0)

Each toggled app's offsite push = one multi-path restic snapshot (recovery unit + TierOffsite
mandatory userdata via ComputeCaptureSet); legacy/undeployed stay unit-only. Loud capture gaps
(SP-3.4: restic 0.14.0 silently skips missing paths). Quota = stats --mode raw-data (SP-1;
displayed size drops once). Pre-push enlargement gate blocks the userdata enlargement over-quota
(unit-only push continues; EnlargedBlocked; edge-triggered notify). forget --group-by host,tags
on both sites (SP-2). Restore reworked: scratch off the rootfs + headroom gate (F-A1), unit-only
default via --include, size-first full, place-to-live missing-only merge (never --delete).
UI: unit/full-two-step/place actions + per-app blocked note; route POST /backup/offbox/place.
HUB FLAG: offbox_enlarge_blocked event needs hub allowlist for push delivery.
+13 tests; all 10 §10 red-proofs verified. No tier-2/.fab/hub/agent changes.

controller/internal/web/server.go

@@ -370,6 +370,8 @@ func (s *Server) ServeHTTP(w http.ResponseWriter, r *http.Request) {
 		s.offboxRunHandler(w, r)
 	case path == "/backup/offbox/restore" && r.Method == http.MethodPost:
 		s.offboxRestoreHandler(w, r)
+	case path == "/backup/offbox/place" && r.Method == http.MethodPost:
+		s.offboxPlaceHandler(w, r)
 	// Controller-driven escrow ceremony wizard (v0.127.0): the customer-facing R flow.
 	case path == "/backup/escrow" && r.Method == http.MethodGet:
 		s.escrowWizardPageHandler(w, r)