v0.109.0: soft-quota gate + usage bar + offsite report status (SLICE 4)

QuotaGB rides the descriptor into OffboxTarget; RepoSizeBytes persisted
from restic stats. Pre-run gate: >=100% refuses NEW backups (Hungarian
notice + operator alert) but prune STILL runs (red-proofed) and restore is
never gated; >=80% warns. /backups usage bar (quota>0 only). The hub
report gains the non-secret offsite status object for the OffsiteChecker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

CHANGELOG.md

@@ -1,5 +1,30 @@
 ## Changelog
 
+### v0.109.0 — SLICE 4: soft-quota gate + usage bar + offsite report status (2026-07-09)
+
+The shared-model soft quota (`quota_gb`) enforced controller-side (pairs with hub v0.41.0's
+OffsiteChecker + freeze lever). No secrets anywhere in this slice — sizes/timestamps only.
+
+- **`internal/settings`:** `OffboxTarget.QuotaGB` (mapped from the hub descriptor by the apply-bridge —
+  `OffboxEnabler` seam gains `quotaGB`; 0 = no soft limit, dedicated boxes are Hetzner-enforced) +
+  `RepoSizeBytes` (machine-readable size persisted from `restic stats` alongside the human string; a failed
+  stats call keeps the last-known value — stale-but-safe).
+- **Pre-run soft-quota gate (`RunOffboxBackup`):** at **≥100%** NEW backup runs are refused —
+  `LastStatus="error"` with the Hungarian notice ("A NAS-mentés túllépte a tárhelykeretet (X/Y GB) — törölj
+  régi mentéseket vagy kérj nagyobb keretet."), operator alert via the existing `offboxNotify` path — but
+  the **retention/prune step STILL RUNS** (`offboxPruneOnly`; pruning is the customer's only way back under
+  quota — gating it would deadlock them) and **restore is never gated**. **Companion red-proof:** gated the
+  prune too → "prune MUST still run over quota, got 0" → test FAILED. Reverted. The gate is pre-run: a run
+  crossing 100% mid-flight finishes; the next refuses. At **≥80%** (<100%) an OK run sets the Hungarian
+  usage `LastWarning` ("A NAS-mentés a keret X%-át használja (A/B GB).").
+- **UI:** `/backups` gains a soft-quota usage bar (used/quota + %, green/amber/red) — rendered only when
+  `QuotaGB > 0`. Template gates green.
+- **`internal/report`:** the hub report gains `offsite:{enabled, escrow_state, last_run, last_status,
+  snapshot_count, repo_size_bytes, quota_gb}` (`backup.OffboxReportStatus`; absent when no offbox target —
+  the hub checker is nil-safe on old controllers).
+- Tests: over-quota refusal (backup 0 calls, prune 1 call, Hungarian status, restore ungated); 84% warn +
+  bytes persisted; quota-0 no gate; report object + nil when unconfigured; bridge quota mapping.
+
 ### v0.108.0 — SLICE 3: hub-verified escrow auto-confirm (current-password hash match) (2026-07-09)
 
 Replaces operator trust with a verified fact (pairs with agent v0.79.0 + hub v0.40.0): the report ACK now