v0.244.0: the backup page stops promising what it does not hold (R-537/R-538/R-536)

R-537 — the contents label is now PER TIER. One string computed from the app's
shape was rendered on all three tier rows; a Tier-1 unit has no file-copy step, so
for the four class-A apps it was claiming „Adatok" for files it does not hold.

R-538 — a unit restore REFUSES before anything is touched when the unit cannot
return the app's drive-side files, and names the route that can. It runs before the
stack is stopped because the measured harm included the app's own wastebasket going
unreachable, which still held every byte.

R-536 — „Alkalmazás telepítve" moved from the deploy's acceptance to its completion,
with app_deploy_started and app_deploy_failed as the honest pair.

Each fix red-proofed: seen failing with its own sentence, passing when restored.
Requires hub v0.116.0 for the two new event types. MinAgent unchanged (0.131.0).

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/api/router.go

@@ -498,7 +498,10 @@ func (r *Router) deployStack(w http.ResponseWriter, req *http.Request, name stri
 		if s, ok := r.stackMgr.GetStack(name); ok && s.Meta.DisplayName != "" {
 			displayName = s.Meta.DisplayName
 		}
-		r.notifier.NotifyAppDeployed(name, displayName)
+		// R-536: this is the ACCEPTANCE, not the installation. `app_deployed` moved to the async
+		// path's own end (stacks.deployDoneHook → Router.OnDeployDone), because the deploy runs after
+		// this returns and an interrupted one used to leave a completed-install record behind.
+		r.notifier.NotifyAppDeployStarted(name, displayName)
 	}
 
 	// Re-sync geo rules (new hostname may need to be added)