v0.26.0: Storage namespace felhom-data/ + test node wipe script

All felhom-managed data on external drives now lives under felhom-data/
subdirectory, cleanly separating controller data from user files.

- backup/paths.go: add FelhomDataDir constant, update 8 path helpers
- stacks/delete.go: add local felhomDataDir constant (circular import
  boundary), update ProtectedHDDPaths + GetStackBackupData
- storage/migrate_drive.go: import backup pkg, fix conflict check, verify,
  rsync excludes (felhom-data/backups/*/restic/), size estimation
- storage/migrate.go: import backup pkg, fix DB dump paths
- web/handlers.go: fix legacy 'storage' path -> backup.AppDataDir()
- storage/format_linux.go: create felhom-data/ instead of storage/
- storage/attach_linux.go: create felhom-data/ instead of storage/
- scripts/felhom-wipe.sh: new multi-level test node wipe script
  (soft/controller/full/nuclear)
- CHANGELOG.md, controller/README.md, scripts/README.md: updated docs

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CHANGELOG.md

@@ -1,5 +1,50 @@
 ## Changelog
 
+### v0.26.0 — Storage Namespace `felhom-data/` + Test Node Wipe Script (2026-02-22)
+
+All felhom-managed data on external drives now lives under a `felhom-data/` subdirectory, cleanly separating controller-managed data from user files. Plus a multi-level wipe script for repeatable test node cleanup.
+
+**Key design principle:** `HDD_PATH` env var stays as the mount point (e.g., `/mnt/hdd_1`). The `felhom-data` segment is embedded in path helpers and compose templates — not in `HDD_PATH`.
+
+#### Changed
+- **`internal/backup/paths.go`** — Added `FelhomDataDir = "felhom-data"` constant. Updated 8 path functions to insert `felhom-data` between the drive root and data subdirectory:
+  - `PrimaryBackupPath` → `<drive>/felhom-data/backups/primary`
+  - `PrimaryResticRepoPath` → `<drive>/felhom-data/backups/primary/restic`
+  - `AppDBDumpPath` → `<drive>/felhom-data/backups/primary/<stack>/db-dumps`
+  - `SecondaryBackupPath` → `<drive>/felhom-data/backups/secondary`
+  - `AppSecondaryRsyncPath` → `<drive>/felhom-data/backups/secondary/<stack>/rsync`
+  - `SecondaryResticRepoPath` → `<drive>/felhom-data/backups/secondary/restic`
+  - `SecondaryInfraPath` → `<drive>/felhom-data/backups/secondary/_infra`
+  - `AppDataDir` → `<drive>/felhom-data/appdata/<stack>`
+  - `InfraBackupDir` **unchanged** — stays at drive root for DR scanner
+- **`internal/stacks/delete.go`** — Added local `felhomDataDir = "felhom-data"` constant (cannot import `backup` due to architectural boundary). Updated `ProtectedHDDPaths()` to protect `<drive>/felhom-data`, `<drive>/felhom-data/appdata`, `<drive>/felhom-data/backups`. Fixed hardcoded paths in `GetStackBackupData()`.
+- **`internal/storage/migrate_drive.go`** — Added `backup` package import. Fixed 4 issues:
+  - Conflict check: uses `backup.AppDataDir()` instead of hardcoded `appdata/`
+  - Verify step: uses `backup.AppDataDir()` instead of hardcoded `appdata/`
+  - rsync excludes: updated from `backups/primary/restic/` to `felhom-data/backups/primary/restic/`
+  - Size estimation: now scans inside `felhom-data/` namespace, skipping restic repos correctly
+- **`internal/storage/migrate.go`** — Added `backup` package import. Post-migration DB dump copy now uses `backup.AppDBDumpPath()` instead of hardcoded paths.
+- **`internal/web/handlers.go`** — Fixed legacy `"storage"` path in storage app detail size calculation (was dead code — path never existed); now uses `backup.AppDataDir()`.
+- **`internal/storage/format_linux.go`** — Format wizard creates `felhom-data/` subdirectory instead of legacy `storage/`.
+- **`internal/storage/attach_linux.go`** — Attach wizard creates `felhom-data/` subdirectory instead of legacy `storage/`.
+
+#### Added
+- **`scripts/felhom-wipe.sh`** — Test node cleanup script with 4 wipe levels:
+  - `soft` — Removes controller state files (settings.json, metrics.db, session/setup/update/snapshot state)
+  - `controller` — Soft + removes all app containers, volumes, and stack directories (skips protected stacks by default)
+  - `full` — Controller + removes `felhom-data/` on all storage drives (also removes old-style `appdata/` and `backups/` for migration compatibility); restarts controller
+  - `nuclear` — Full + removes controller.yaml, all infrastructure containers (controller, traefik, cloudflared, portainer), DR markers, and runs `docker system prune -af --volumes`
+  - Auto-detects paths from `controller.yaml` and `settings.json`
+  - Dry-run by default; requires `--yes` to execute
+  - Interactive confirmation prompt with `--yes` execution
+
+#### Notes
+- **Migration**: Pre-v0.26.0 restic snapshots reference old paths (without `felhom-data/`). Existing installations need data migration before upgrading.
+- **App catalog**: Compose templates need separate update: `${HDD_PATH}/appdata/` → `${HDD_PATH}/felhom-data/appdata/` (tracked as separate task).
+- All backup, crossdrive, and restore logic automatically picks up new paths via `paths.go` helpers — no changes needed in `backup.go`, `crossdrive.go`, or `restore.go`.
+
+---
+
 ### v0.25.0 — Debug Page: Operator Testing & Diagnostics Dashboard (2026-02-21)
 
 **Full debug dashboard with 8 sections for testing all controller subsystems in debug mode.**