docs: Phase 3 off-drive Tier 2 — REPORT/CONTEXT/README for v0.55.0

REPORT (Tier 2 engine + rootfs-headroom guard + live validation: happy path RomM->SSD
off felhom-usb, refuse path 1G dummy -> honest "needs 2nd HDD", UI card). CONTEXT entry.
README Tier 2 subsection.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CONTEXT.md

@@ -13,6 +13,19 @@ Last updated: 2026-06-12 (storage UX polish)
 > is tracked in `CHANGELOG.md`, `controller/README.md`, and the auto-memory `MEMORY.md`. Live version:
 > **v0.45.0**.
 >
+> **2026-06-13 — v0.55.0 Phase 3: auto off-drive Tier 2 (rootfs-headroom guard):**
+> - `internal/backup/tier2.go`: rsync `-a --delete` of each HDD app's recovery unit + appdata → a
+>   DIFFERENT physical disk (`<target>/backups/secondary/<app>/`). Auto target: prefer another registered
+>   drive (off-disk via `system.SamePhysicalDevice`), else internal SSD for SMALL units only.
+> - **Rootfs-headroom guard** (`tier2FitsHeadroom`, unit-tested): SSD = ~8G guest rootfs, so REFUSE
+>   unless the unit fits leaving reserve = max(2G, 20%) free; honest "needs 2nd HDD" status when nothing
+>   fits — never fills the rootfs. Status via surviving `settings.CrossDriveBackup`; "2. mentés" UI card
+>   now populated (`buildAppBackupRows`). Daily `tier2-backup` 03:30 + `POST /api/backup/tier2`.
+> - **Live-validated (9201):** happy path (RomM → SSD, off felhom-usb, 77KB, "[SSD: DB/config only]");
+>   refuse path (1G userdata dummy → REFUSED with honest msg, rootfs not filled); UI card shows
+>   "Sikeres → belső SSD (csak DB/konfiguráció)". Demo cleaned.
+> - Next: Phase 4 (FileBrowser scoping + deploy-UI DB-on-SSD note + monitoring sort).
+>
 > **2026-06-13 — v0.53.0/v0.53.1 Phase 2: per-app recovery unit (capture side, SECRET-FREE):**
 > - Each app's `backups/primary/<app>/` becomes a self-contained recovery unit: `compose/`
 >   (docker-compose.yml + .felhom.yml + **secret-stripped** app.yaml) + db-dumps/ + volume-dumps/ +