feat(shares): R-7b Part 3 — offsite shares leg (Model B') + B' isolation proof

ONE additional restic call tagged [felhom-offbox, _shares] carrying the payload
staging dir + every mandatory share folder. Hooked into runOffboxInternal AFTER the
per-app loop and BEFORE retention, so forget --group-by host,tags covers the _shares
group with no flag change. Reuses resticStep, the caller's repo-ensure and
single-flight, and the SAME enlargement-gate arithmetic.

- quota gate degrades the push to MANIFEST-ONLY, never to nothing
- EnlargedBlocked keeps the RAW _shares key (templates index by it); the display
  mapping applies only at the notification + Hungarian-prose boundaries
- OffboxTarget gains SharesLastRun/Status/Count for per-tier page truth
- zero-toggle notice suppressed when the shares leg provided coverage
- reserved-name defense: an app keyed _shares is excluded from the run loudly

RED-PROOFS RUN AND REVERTED (all fired):
  1. shares leg appends into the app's argv -> isolation test FAILS
  2. mandatory->offsite mapping inverted    -> Scenario A + B FAIL
  3. manifest-only degradation dropped      -> Scenario C FAILS

controller/internal/backup/shares_test.go

@@ -398,6 +398,46 @@ func TestSharesTier2ReconcilePrunesRemovedShare(t *testing.T) {
 	}
 }
 
+// The tier-2 half of the B′ isolation proof: the shares job must write ONLY under
+// backups/secondary/_shares. A per-app dest tree standing beside it must come out byte-for-byte
+// untouched — same contents, same bytes — and no mirror call may target it. Red-proof: point the
+// shares destBase at backups/secondary/<share> (dropping the _shares segment) and this fails.
+func TestSharesTier2LeavesPerAppTreeUntouched(t *testing.T) {
+	env := newSharesEnv(t, "hdd_1", "hdd_2")
+	env.addShare(t, "hdd_1", "dokumentumok", true)
+
+	// A pre-existing per-app tier-2 dest with a sentinel payload.
+	appDest := filepath.Join(NamespaceRoot(env.drives["hdd_2"], true), "backups", "secondary", "immich")
+	if err := os.MkdirAll(filepath.Join(appDest, "recovery-unit"), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	sentinel := filepath.Join(appDest, "recovery-unit", "manifest.json")
+	if err := os.WriteFile(sentinel, []byte(`{"app":"immich"}`), 0o644); err != nil {
+		t.Fatal(err)
+	}
+
+	if err := env.m.RunSharesTier2(); err != nil {
+		t.Fatal(err)
+	}
+
+	b, err := os.ReadFile(sentinel)
+	if err != nil || string(b) != `{"app":"immich"}` {
+		t.Errorf("B′ INVARIANT VIOLATED — the per-app tier-2 tree was modified: %q, %v", b, err)
+	}
+	for _, call := range env.mirrored {
+		if strings.Contains(call, appDest) {
+			t.Errorf("B′ INVARIANT VIOLATED — a shares mirror targeted the per-app dest: %s", call)
+		}
+	}
+	// And everything it DID write lives under the reserved subtree.
+	sharesRoot := filepath.Join(NamespaceRoot(env.drives["hdd_2"], true), "backups", "secondary", SharesPseudoStack)
+	for _, dst := range env.mirroredDsts() {
+		if !strings.HasPrefix(dst, sharesRoot+string(filepath.Separator)) {
+			t.Errorf("shares job wrote outside its reserved subtree: %s", dst)
+		}
+	}
+}
+
 // Drive keys must be collision-free across drives that share a basename.
 func TestSharesDriveKeyIsCollisionFree(t *testing.T) {
 	if sharesDriveKey("/mnt/a/data") == sharesDriveKey("/mnt/b/data") {