docs: Phase 3 off-drive Tier 2 — REPORT/CONTEXT/README for v0.55.0

REPORT (Tier 2 engine + rootfs-headroom guard + live validation: happy path RomM->SSD
off felhom-usb, refuse path 1G dummy -> honest "needs 2nd HDD", UI card). CONTEXT entry.
README Tier 2 subsection.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/README.md

@@ -378,6 +378,18 @@ backups/primary/<app>/
   the capture never touches a secret). `data_key` fields are marked in `.felhom.yml`
   (`DeployField.DataKey`).
 
+#### Tier 2 — off-drive copy (Phase 3, v0.55.x)
+
+For every HDD app, Tier 2 (`internal/backup/tier2.go`) rsync-mirrors the recovery unit
+(`backups/primary/<app>/`) + the app's `appdata/<app>/` to `<target>/backups/secondary/<app>/` on a
+**different physical disk** — the only off-drive protection bind-mounted HDD userdata can get (PBS can't
+reach bind mounts). Auto-targeted: **prefer another registered user-data drive** (off-disk via
+`system.SamePhysicalDevice`); else the **internal SSD for small units only**, behind a size-aware
+**rootfs-headroom guard** (`tier2FitsHeadroom`) that **refuses rather than fills** the ~8 GB guest rootfs
+(reserve = `max(2 GB, 20%)`), recording an honest "needs a 2nd HDD" status. Status persists via
+`settings.CrossDriveBackup` and drives the "2. mentés" card. Runs daily (`tier2-backup`, 03:30) or via
+`POST /api/backup/tier2`. restic is **not** used — a plain browsable mirror.
+
 **Phase 1 — Database Dumps** (`internal/backup/dbdump.go`, scheduled 02:30)
 
 - **Auto-discovery** of PostgreSQL and MariaDB containers via `docker ps` + `docker inspect`