R-101 + F-DIAG: the restore dialog names the last SUCCESSFUL copy (v0.182.0)

Tier2LastRun is the attempt clock and was rendered as 'Legutóbbi másolat' in the restore
confirm dialog. New LastSuccess + SuccessTracked anchor; tier2Update makes the three
rebuild sites safe by construction. F-DIAG: six distinct causes, target-aware redaction.

controller/internal/web/tier2_legacy.go

@@ -0,0 +1,29 @@
+package web
+
+import "sync"
+
+// R-101: a Tier-2 row written before the success anchor existed renders exactly as it did before —
+// „Utolsó: <idő>" from the ATTEMPT clock. That is the mandated degrade direction: showing
+// „Még nincs sikeres másolat" for a row that merely predates the field would have told all seven rows
+// on the fleet, at once, that their backups do not exist.
+//
+// It is logged ONCE per stack because it is a steady state until that app's next run (nightly), not an
+// event — but it is logged at all, so a fleet quietly rendering on the old anchor is visible rather
+// than assumed. Same shape as the hub's R-100 legacy degrade.
+var tier2LegacyMu sync.Mutex
+var tier2LegacyWarned map[string]bool
+
+func (s *Server) noteTier2LegacyOnce(stackName string) {
+	tier2LegacyMu.Lock()
+	defer tier2LegacyMu.Unlock()
+	if tier2LegacyWarned == nil {
+		tier2LegacyWarned = map[string]bool{}
+	}
+	if tier2LegacyWarned[stackName] {
+		return
+	}
+	tier2LegacyWarned[stackName] = true
+	if s.logger != nil {
+		s.logger.Printf("[INFO] [tier2] %s: no success anchor yet (row predates R-101) — showing the last ATTEMPT time until this app's next run writes one", stackName)
+	}
+}