docs: REPORT + README for v0.93.0 (NAS Part B off-box backup, live-validated A-D)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01HxLA1mZurFq9kt8hneFeCs

controller/README.md

@@ -635,6 +635,25 @@ not just those with HDD data. Non-HDD apps can configure destination, method, an
 
 ### 4. Storage Management
 
+> **Off-box (NAS) backup — restic-over-SFTP (v0.93.0, Part B).** The "1 off-site" leg of 3-2-1 for the
+> app-data tier: each off-box-toggled app's recovery unit + DB dumps + volume tars are backed up to the
+> customer's NAS as an **encrypted restic repo over SFTP** (`internal/backup/offbox.go`). No kernel mount —
+> restic talks SFTP directly; the NAS sees only ciphertext. Distinct from the local cross-drive rsync copy
+> and the agent's PBS whole-CT DR.
+> - **Fail-fast (load-bearing):** every restic call uses `-o sftp.command="ssh … -oConnectTimeout=10 … -s
+>   sftp"` so a dead NAS errors in ~10 s, never hangs the backup runner; a failure raises the `backup_failed`
+>   operator alert. `-oStrictHostKeyChecking=yes` + a pinned `known_hosts` (no blind TOFU).
+> - init-if-absent (idempotent), `forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune`,
+>   single-flight (shares `m.running`) + migration-guard, restic's own exit code checked, restore to a
+>   scratch dir (non-destructive).
+> - **Secrets** (SSH key + auto-gen repo password) are **0600 files in the data dir** — never logged/committed;
+>   they ride DR via the PBS whole-CT snapshot of the rootfs (the recovery-unit/dr-recipe stay secret-free).
+> - **Injection guard** (`ValidateOffboxTarget`): host/user/repo must not start with `-` (ssh
+>   option-injection) or carry metacharacters/traversal; `OffboxConfigured` fails closed on an invalid
+>   target. Image: `restic` + `openssh-client` (re-added; restic's sftp backend shells out to `ssh`).
+> - UI: the "Külső (NAS) mentés" section on the backups page (configure target, per-app toggles, run-now,
+>   restore, status). Config: `settings.OffboxTarget` + per-app `AppBackupPrefs.Offbox`. Daily at 04:15.
+
 > **NAS network storage (v0.92.0, Part A2; pairs with agent v0.50.0).** A customer NAS share (NFS or SMB)
 > is a **distinct storage KIND** from a physical drive (`StoragePath.Kind == "network"`), for **bulk media**.
 > The controller is a thin proxy over the agent's `/netstorage/*` (A1) + the local registry — it holds **no