v0.109.0: soft-quota gate + usage bar + offsite report status (SLICE 4)

QuotaGB rides the descriptor into OffboxTarget; RepoSizeBytes persisted
from restic stats. Pre-run gate: >=100% refuses NEW backups (Hungarian
notice + operator alert) but prune STILL runs (red-proofed) and restore is
never gated; >=80% warns. /backups usage bar (quota>0 only). The hub
report gains the non-secret offsite status object for the OffsiteChecker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/report/builder.go

@@ -170,6 +170,9 @@ func BuildReport(
 		if host, user, port, repoPath, ok := backupMgr.OffboxCoord(); ok {
 			r.DRRecipe.OffsiteRestic = &DRResticCoord{Host: host, User: user, Port: port, RepoPath: repoPath}
 		}
+		// SLICE 4: the non-secret offsite status object — the hub's OffsiteChecker input (fill +
+		// staleness). nil (absent on the wire) when no offbox target is enabled.
+		r.Offsite = backupMgr.OffboxReportStatus()
 	}
 
 	if debug && logger != nil {

controller/internal/report/types.go

@@ -3,6 +3,7 @@ package report
 import (
 	"time"
 
+	"gitea.dooplex.hu/admin/felhom-controller/internal/backup"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/metrics"
 )
 
@@ -28,6 +29,11 @@ type Report struct {
 	// DR recipe — the controller (customer + apps) half of the secret-free reconstruction recipe
 	// (SPIKE-dr-recipe-2026-06-16). The hub assembles it with the agent's storage/guest/PBS half.
 	DRRecipe *DRRecipeAppHalf `json:"dr_recipe,omitempty"`
+
+	// Offsite (SLICE 4) — the non-secret offbox status for the hub's OffsiteChecker (fill + staleness
+	// alerts). Absent when no offbox target is enabled (and on pre-v0.109 controllers — the checker is
+	// nil-safe on both).
+	Offsite *backup.OffboxReportStatus `json:"offsite,omitempty"`
 }
 
 // SystemReport holds host-level system info.