v0.51.0: offsite-backup UI (felhom-pbs DR) + Model-A double-nest fix

- Backups page: whole-guest backup shown as real DR — target label "Biztonsági szerver –
  külön hardver (PBS)"; app-data "Távoli mentés" card now reflects the PBS offsite tier
  (guestBackupView.Offsite) instead of "nincs beállítva".
- Model-A double-nest fix: appbackup path helpers take a felhom-data NAMESPACE ROOT (no
  internal felhom-data join); backup.Manager.namespaceRoot/AppNamespaceRoot resolve
  HDD-vs-systemDataPath provenance so a drive-resident app's backups land single-nested
  (<drive>/backups/... on the guest = <drive>/felhom-data/backups/... on the host) instead
  of .../felhom-data/felhom-data/.... Writes, deletion (GetStackBackupData/RemoveStack/
  ProtectedHDDPaths), wipe-warning scan, and export updated coherently; legacy double-nest
  dirs kept protected. New appbackup test asserts no doubled segment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/appbackup/paths.go

@@ -10,22 +10,40 @@ import "path/filepath"
 // FelhomDataDir is the namespace directory on storage drives for all felhom-managed data.
 const FelhomDataDir = "felhom-data"
 
-// PrimaryBackupPath returns the root primary backup directory for a drive.
-func PrimaryBackupPath(drivePath string) string {
-	return filepath.Join(drivePath, FelhomDataDir, "backups", "primary")
+// NamespaceRoot resolves the felhom-data namespace ROOT for a drive path. All the path helpers
+// below take this namespace root (the directory that directly contains backups/ and appdata/),
+// NOT a bare drive path — they do not append felhom-data themselves.
+//
+// Model A (slice 10): the host agent binds <drive>/felhom-data onto the guest mountpoint, so an
+// enrolled user-data drive's IN-GUEST mount already IS the namespace root (and its basename need
+// NOT be "felhom-data" — e.g. /mnt/felhom-usb). For such mounts pass inGuestDrive=true → the path
+// is returned as-is, so callers no longer double-nest into .../felhom-data/felhom-data/... .
+//
+// For a bare drive root that still holds a felhom-data SUBDIR — the SSD-only system-data fallback,
+// or any legacy host-side layout — pass inGuestDrive=false → the felhom-data segment is appended.
+func NamespaceRoot(drivePath string, inGuestDrive bool) string {
+	if inGuestDrive {
+		return filepath.Clean(drivePath)
+	}
+	return filepath.Join(drivePath, FelhomDataDir)
 }
 
-// AppDBDumpPath returns the DB dump directory for an app on its home drive.
-func AppDBDumpPath(drivePath, stackName string) string {
-	return filepath.Join(drivePath, FelhomDataDir, "backups", "primary", stackName, "db-dumps")
+// PrimaryBackupPath returns the root primary backup directory under a felhom-data namespace root.
+func PrimaryBackupPath(nsRoot string) string {
+	return filepath.Join(nsRoot, "backups", "primary")
 }
 
-// AppVolumeDumpPath returns the directory for Docker volume dump tars on an app's home drive.
-func AppVolumeDumpPath(drivePath, stackName string) string {
-	return filepath.Join(drivePath, FelhomDataDir, "backups", "primary", stackName, "volume-dumps")
+// AppDBDumpPath returns the DB dump directory for an app under a felhom-data namespace root.
+func AppDBDumpPath(nsRoot, stackName string) string {
+	return filepath.Join(nsRoot, "backups", "primary", stackName, "db-dumps")
 }
 
-// AppDataDir returns the app data directory path on a drive.
-func AppDataDir(drivePath, stackName string) string {
-	return filepath.Join(drivePath, FelhomDataDir, "appdata", stackName)
+// AppVolumeDumpPath returns the Docker-volume dump-tar directory for an app under a namespace root.
+func AppVolumeDumpPath(nsRoot, stackName string) string {
+	return filepath.Join(nsRoot, "backups", "primary", stackName, "volume-dumps")
+}
+
+// AppDataDir returns the app data directory under a felhom-data namespace root.
+func AppDataDir(nsRoot, stackName string) string {
+	return filepath.Join(nsRoot, "appdata", stackName)
 }