v0.109.0: soft-quota gate + usage bar + offsite report status (SLICE 4)

QuotaGB rides the descriptor into OffboxTarget; RepoSizeBytes persisted
from restic stats. Pre-run gate: >=100% refuses NEW backups (Hungarian
notice + operator alert) but prune STILL runs (red-proofed) and restore is
never gated; >=80% warns. /backups usage bar (quota>0 only). The hub
report gains the non-secret offsite status object for the OffsiteChecker.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/settings/settings.go

@@ -118,6 +118,10 @@ type OffboxTarget struct {
 	User     string `json:"user"`
 	RepoPath string `json:"repo_path"` // absolute path on the NAS, e.g. /volume1/felhom-backup/repo
 	Schedule string `json:"schedule"`  // "daily" | "manual"
+	// QuotaGB is the shared-model SOFT quota (SLICE 4), mapped from the hub descriptor by the
+	// apply-bridge. 0 = no soft limit (dedicated boxes are Hetzner-enforced; manual targets unset).
+	// Felhom-enforced: at ≥100% NEW backup runs are refused (prune/restore never are); ≥80% warns.
+	QuotaGB int `json:"quota_gb,omitempty"`
 
 	// Runtime status (written by the off-box runner; never holds a secret).
 	LastRun       string `json:"last_run,omitempty"`    // RFC3339
@@ -125,7 +129,10 @@ type OffboxTarget struct {
 	LastError     string `json:"last_error,omitempty"`
 	LastDuration  string `json:"last_duration,omitempty"`
 	RepoSizeHuman string `json:"repo_size_human,omitempty"`
-	SnapshotCount int    `json:"snapshot_count,omitempty"`
+	// RepoSizeBytes (SLICE 4) is the machine-readable repo size from `restic stats` — the soft-quota
+	// gate's input (last-known value; a failed stats call keeps the previous one — stale-but-safe).
+	RepoSizeBytes int64 `json:"repo_size_bytes,omitempty"`
+	SnapshotCount int   `json:"snapshot_count,omitempty"`
 	// LastWarning is a customer-visible notice set on an otherwise-OK run when SOME toggled apps had
 	// no discoverable recovery unit (partial run). Empty on a fully-successful or failed run.
 	LastWarning string `json:"last_warning,omitempty"`