v0.277.0: kept data loads from the off-site copy too (R-691 (2))

Use my kept data / Load consider the off-site snapshot when it is newer than every local copy or
the only one; the unit is downloaded alone, judged (drive, data, recorded data version) and only
then restored. The page names the copy and its date.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/backup/offbox_inventory.go

@@ -56,6 +56,9 @@ type OffsiteInventory struct {
 type offsiteNewest struct {
 	id string
 	at time.Time
+	// paths are the snapshot's captured paths (R-691 (2): the kept-data choice asks whether the newest
+	// snapshot holds the app's recovery unit without a second repository call).
+	paths []string
 }
 
 // offsiteNewestPerTag runs ONE `snapshots --json` and returns the newest snapshot per app tag, and
@@ -81,6 +84,7 @@ func (m *Manager) offsiteNewestPerTag(ctx context.Context) (map[string]offsiteNe
 		ID      string    `json:"id"`
 		Time    time.Time `json:"time"`
 		Tags    []string  `json:"tags"`
+		Paths   []string  `json:"paths"`
 	}
 	if uerr := json.Unmarshal(out, &snaps); uerr != nil {
 		return nil, false, uerr
@@ -100,7 +104,7 @@ func (m *Manager) offsiteNewestPerTag(ctx context.Context) (map[string]offsiteNe
 				continue
 			}
 			if cur, ok := newest[tag]; !ok || sn.Time.After(cur.at) {
-				newest[tag] = offsiteNewest{id: id, at: sn.Time}
+				newest[tag] = offsiteNewest{id: id, at: sn.Time, paths: sn.Paths}
 			}
 		}
 	}