v0.185.0 — E-2 Parts 3+4: the offer, and the honest degraded state

The half that makes the rest work: a degraded backup target recorded only in
config is the silent-degradation pattern this arc has spent a week removing.

Part 3 -- POST /api/backup-target/assign moves the target via the agent's
POST /backup/target. It is the ONLY writer of the role: registration does not set
it, the drive-gate does not, no scheduler does. Declining is not calling it. The
agent returns restart_required rather than restarting itself, because restarting
with a backup in flight records a spurious tier failure for a backup that
actually succeeded (E-1 did exactly that).

Part 4 -- GET /api/backup-target returns the state and, when degraded, Hungarian
copy in FACT -> CONSEQUENCE -> REMEDY order, pinned by a test: a customer told
only the fact cannot act on it.

Healthy renders NOTHING -- no badge, no reassurance, no tonal change.
degradedMessageFor is the single decision point, so exactly one place could start
decorating a working box. Red-proofed: reassuring on the healthy branch fails
Scenario E.

UNKNOWN is not degraded: an unreachable or pre-R-82 agent means we could not ask,
which is not evidence of degradation (R-88 Part 2's class).

A HOLLOW TEST caught by its own red-proof: TestUnknownStateRendersNothing used
{Known:false} with Degraded left false, so it passed even with the !Known guard
deleted -- the second condition covered for it. Now {Known:false, Degraded:true},
which fails properly. Without the red-proof the test would have been decoration.

State is derived from the AGENT, never from our intent flag: on the two boxes
migrated by hand in E-1 the intent was never recorded while the drive really is
the target.

MinAgent: 0.113.0
Green gate: build + vet + test rc=0 (27 packages), run separately from this commit.

controller/internal/web/storage_handlers.go

@@ -354,6 +354,12 @@ func (s *Server) ServeStorageAPI(w http.ResponseWriter, r *http.Request) {
 		s.handleStorageImpact(w, r)
 	case r.URL.Path == "/api/storage/register" && r.Method == http.MethodPost:
 		s.handleStorageRegister(w, r)
+	// E-2 Parts 3+4. State drives the degraded banner and the OFFER; assign is the offer's
+	// ACCEPTANCE and the ONLY writer of the role — registration above deliberately does not set it.
+	case r.URL.Path == "/api/backup-target" && r.Method == http.MethodGet:
+		s.handleBackupTargetState(w, r)
+	case r.URL.Path == "/api/backup-target/assign" && r.Method == http.MethodPost:
+		s.handleBackupTargetAssign(w, r)
 	case r.URL.Path == "/api/storage/migrate" && r.Method == http.MethodPost:
 		s.handleStorageMigrate(w, r)
 	case r.URL.Path == "/api/storage/migrate-app" && r.Method == http.MethodPost: