v0.51.0: offsite-backup UI (felhom-pbs DR) + Model-A double-nest fix

- Backups page: whole-guest backup shown as real DR — target label "Biztonsági szerver –
  külön hardver (PBS)"; app-data "Távoli mentés" card now reflects the PBS offsite tier
  (guestBackupView.Offsite) instead of "nincs beállítva".
- Model-A double-nest fix: appbackup path helpers take a felhom-data NAMESPACE ROOT (no
  internal felhom-data join); backup.Manager.namespaceRoot/AppNamespaceRoot resolve
  HDD-vs-systemDataPath provenance so a drive-resident app's backups land single-nested
  (<drive>/backups/... on the guest = <drive>/felhom-data/backups/... on the host) instead
  of .../felhom-data/felhom-data/.... Writes, deletion (GetStackBackupData/RemoveStack/
  ProtectedHDDPaths), wipe-warning scan, and export updated coherently; legacy double-nest
  dirs kept protected. New appbackup test asserts no doubled segment.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/web/storage_handlers.go

@@ -324,12 +324,13 @@ func (s *Server) handleStorageImpact(w http.ResponseWriter, r *http.Request) {
 }
 
 // backupCopiesOnPath lists the apps whose CROSS-DRIVE (secondary) backup copies are stored on the
-// drive mounted at `where` (slice 10 P4) — the felhom-data/backups/secondary/<app> dirs. A wipe of
-// this drive removes these copies. Best-effort filesystem scan; empty until the cross-drive backup
-// ENGINE (a follow-on slice) actually writes here. Shared/aggregate dirs (restic repo, _infra) are
-// not apps and are skipped.
+// drive mounted at `where` (slice 10 P4) — the backups/secondary/<app> dirs. A wipe of this drive
+// removes these copies. Best-effort filesystem scan; empty until the cross-drive backup ENGINE (a
+// follow-on slice) actually writes here. Shared/aggregate dirs (restic repo, _infra) are not apps
+// and are skipped. Model A: `where` is the in-guest drive mount, which IS the felhom-data namespace
+// root, so backups/ sits directly under it (no felhom-data segment — avoids the double-nest).
 func backupCopiesOnPath(where string) []string {
-	secondary := filepath.Join(where, appbackup.FelhomDataDir, "backups", "secondary")
+	secondary := filepath.Join(appbackup.NamespaceRoot(where, true), "backups", "secondary")
 	entries, err := os.ReadDir(secondary)
 	if err != nil {
 		return nil // no secondary backups here (or the path isn't readable) — nothing to warn about