v0.244.0: the backup page stops promising what it does not hold (R-537/R-538/R-536)

R-537 — the contents label is now PER TIER. One string computed from the app's
shape was rendered on all three tier rows; a Tier-1 unit has no file-copy step, so
for the four class-A apps it was claiming „Adatok" for files it does not hold.

R-538 — a unit restore REFUSES before anything is touched when the unit cannot
return the app's drive-side files, and names the route that can. It runs before the
stack is stopped because the measured harm included the app's own wastebasket going
unreachable, which still held every byte.

R-536 — „Alkalmazás telepítve" moved from the deploy's acceptance to its completion,
with app_deploy_started and app_deploy_failed as the honest pair.

Each fix red-proofed: seen failing with its own sentence, passing when restored.
Requires hub v0.116.0 for the two new event types. MinAgent unchanged (0.131.0).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/README.md

@@ -1636,7 +1636,7 @@ Unified per-app status table with expandable rows showing **per-tier** backup st
 Every app starts as yellow (1 tier only). Green requires Tier 2 configured with successful backup.
 
 **Per-app backup tiers (3 rows per app):**
-- **1. mentes** (Tier 1, always present) — Auto badge + "helyi" + last run + contents (e.g., "DB + Konfig + Adatok")
+- **1. mentes** (Tier 1, always present) — Auto badge + "helyi" + last run + contents. **The contents label is PER TIER (v0.244.0, R-537):** it describes what that tier actually captured, not what the app is shaped like.
 - **2. mentes** (Tier 2, configurable for ALL apps) — one of:
   - Configured: method (rsync/restic) + destination + schedule + last run + status + contents + browsable indicator (folder icon for rsync) + action buttons
   - Not configured: "1. mentes auto" + "Nincs 2. masolat" + settings link
@@ -1645,10 +1645,10 @@ Every app starts as yellow (1 tier only). Green requires Tier 2 configured with
   ("Kulcsletetre var"), `active` (status badge + "restic -> <host>" + relative last-run)
 
 **Backup contents per app** (shown per tier):
-- Apps with DB + HDD: "DB + Konfig + Adatok"
-- Apps with Docker volumes (no HDD): "Konfig + DB + Adatok" or "Konfig + Adatok"
+- Apps whose files live on the data drive (class A: calibre-web, immich, nextcloud, paperless-ngx): Tier 1 reads **"DB + Konfig"** — a Tier-1 unit has no file-copy step, so it does not hold them — and a sentence under the row says the files are protected by the off-site copy (and a second drive). Tier 2/3 read "DB + Konfig + Adatok", because those tiers DO carry the file legs.
+- Apps whose data is entirely in Docker volumes (45 of 53 templates): "Konfig + DB + Adatok" or "Konfig + Adatok" on every tier — the unit really does hold their data.
 - Apps with DB only: "DB + Konfig"
-- Apps with HDD, no DB: "Konfig + Adatok"
+- **The restore refuses rather than lying (v0.244.0, R-538):** „Visszaállítás indítása" on a unit that cannot return an app's drive-side files is REFUSED before anything is stopped, naming the route that can (the off-site „Teljes visszaállítás (fájlok + adatbázis)", or the second drive's „Fájlok visszaállítása"), and saying plainly when no copy exists. A database-and-settings-only restore is a separately-worded second step.
 - Apps with neither: "Konfig"
 
 **Deploy page** shows cross-drive (Tier 2) configuration form for **all deployed apps**,