controller v0.50.0: slice 10 P4 — dual-role drives + backup-aware wipe warning

4A: user-data drives are backup-target-eligible (not role-locked) — surfaced in
the drive purpose note. 4B: handleStorageImpact returns backup_copies (apps whose
cross-drive backups live on the drive, via backupCopiesOnPath); the wipe/eject
modal warns they'd be destroyed (stays customer-confirmable — copies redundant).
Cross-drive backup engine remains out of scope. Test: TestBackupCopiesOnPath.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,24 @@
 ## Changelog
 
+### v0.50.0 — slice 10 P4: dual-role drives + backup-aware wipe warning (2026-06-12)
+
+Pairs with felhom-agent P3 (self-heal). Establishes the dual-role MODEL + the backup-aware wipe
+warning; the cross-drive backup ENGINE (restic USB1↔USB2) is a follow-on slice (needs a 2nd physical
+drive to validate) and is deliberately NOT built here.
+
+- **4A dual-role eligibility:** a user-data drive is appdata AND backup-target-eligible (it may hold
+  cross-drive backup copies of *other* drives) — it is not locked to a single role. Surfaced in the
+  drive overview's per-card purpose note ("Más meghajtók biztonsági mentési céljaként is szolgálhat").
+  `felhom-pbs` stays the dedicated whole-guest backup datastore (operator-signature); system/backup
+  roles unchanged.
+- **4B backup-aware wipe/eject warning:** `handleStorageImpact` now also returns `backup_copies` — the
+  apps whose cross-drive (secondary) backups are stored on the drive (`backupCopiesOnPath` scans
+  `felhom-data/backups/secondary/<app>`, skipping the shared restic repo / `_infra`). The type-to-
+  confirm modal names them ("Ez a meghajtó más alkalmazások biztonsági másolatait is tárolja — a
+  törlés ezeket is eltávolítja"). The wipe stays **customer-confirmable** (the copies are redundant —
+  originals live on the source drive), not operator-signature. Forward-compatible: empty until the
+  cross-drive engine writes there. Test: `TestBackupCopiesOnPath`.
+
 ### v0.49.0 — slice 10 P2 activation: pending-drive detection + "Újraindítás most" (2026-06-12)
 
 A drive enrolled into a running guest activates only at the next guest boot (the host-side live inject