Tier-2 engine rework: class-driven legs, v2 layout, NAS-target exclusion (Task 3b, v0.135.0)

tier2_capture.go: classified apps get TierSecondary per-bind legs (paperless copy shrinks — export
drops); legacy apps keep the byte-identical resolver set. v2 relpath-mirroring layout
(backups/secondary/<stack>/{marker LAST, recovery-unit/, hdd/<rel>/, userdata/<rel>/}); N>1 native
(errTier2MultiDir/tier2AppDataName deleted). Migration=delete-and-rebuild + reconcile; all RemoveAll
via tier2SafeRemove (refuses outside backups/secondary/). SSD=state-only tier. selectTier2Target
never picks network storage (pinned+auto, F-6C-1). Restore reads v2 behind a marker gate.
Part 0: offbox_enlarge_blocked is a persisted one-time Load seed (opt-out sticks), not a getter
append. Part 0.5: offsite restore scratch prefers a local (non-network) path.
Full v2 test suite + all 10 §10 red-proofs verified. Destructive writes bounded to backups/secondary/.

controller/README.md

@@ -436,6 +436,17 @@ retired in v0.126.0 when the moved blocks were legitimately rewritten onto the s
   ONE local copy — `FullBackupStatus.SingleCopyWarning` surfaces an honest Hungarian notice on the
   backup page ("Csak egy másolat készül…") instead of implying a 3-2-1 guarantee the box cannot keep.
 - The `AppBackupPrefs.Enabled` field in settings.json is legacy and not read by any code.
+- **v2 layout + class-driven legs (v0.135.0, Task 3b):** `backups/secondary/<stack>/` is the v2
+  relpath-mirroring layout — `.felhom-tier2-layout` marker (written LAST) + `recovery-unit/` +
+  `hdd/<relpath>/` + `userdata/<relpath>/`. For a **classified** app the appdata leg is the
+  `TierSecondary` capture set (per-bind mandatory + optional; excluded drops out — `tier2_capture.go`);
+  **legacy** apps keep a byte-identical resolver set in the same layout. N>1 appdata dirs + nested
+  binds are native (the old flat-appdata N>1 refusal is gone). First v2 run per app = delete-and-rebuild
+  of the old flat `appdata/` + a reconcile pass that prunes dest dirs a bind no longer covers; all
+  removals go through `tier2SafeRemove` (refuses anything outside `backups/secondary/`). The **SSD**
+  fallback is a state-only tier (unit + mandatory; optional skipped, honest reason). **NETWORK (NAS)
+  storage is never a tier-2 target** — pinned or auto (F-6C-1: rsync `-og` under root_squash →
+  wrong-owner restore). Restore reads v2 behind the marker gate; a pre-v2 copy is refused.
 
 **Per-app Tier 2 contents by app type:**