v0.231.0: the off-site proof gets a by-hand trigger, like its integrity sibling (R-87)

Without it the only way to see the job work is to wait for 05:30, which makes live
validation and any future diagnosis a next-day exercise. Same function as the scheduled
job - no second code path.

ONE deliberate difference from the integrity button: due-ness is NOT bypassed. There,
forcing means "check the store again", which is always answerable. Here due-ness IS the
target selection - an app is due when its newest snapshot has not been proved - so
ignoring it would mean inventing a second way to choose an app, exactly what having one
function prevents. When nothing is due the button says so, honestly.

Every other guard intact, including the single-writer flag: a hand-run during a backup
SKIPS exactly as the scheduled one would.

POST /api/debug/backup/offsite-proof, button beside "Restic integritas" on the debug page.
debug_route_gate pairs the two, so a button with no dispatch (R-400's shape) cannot ship.

controller/internal/web/templates/debug.html

@@ -82,6 +82,9 @@
 
             <button class="btn btn-secondary btn-sm" id="btn-integrity" data-label="Restic integritás" onclick="triggerAction('btn-integrity','/api/debug/backup/integrity','POST')">Restic integritás</button>
             <span class="debug-result" id="btn-integrity-result"></span>
+
+            <button class="btn btn-secondary btn-sm" id="btn-offsite-proof" data-label="Távoli mentés tartalma" onclick="triggerAction('btn-offsite-proof','/api/debug/backup/offsite-proof','POST')">Távoli mentés tartalma</button>
+            <span class="debug-result" id="btn-offsite-proof-result"></span>
         </div>
     </div>
 </div>