v0.104.0: off-box unit discovery (durable, deployment-independent) + no-silent-success

offbox located each toggled app's recovery unit via AppNamespaceRoot→GetAppDrivePath,
which reads the app's LIVE app.yaml HDD_PATH and silently falls back to systemDataPath
when the app isn't deployed → looked on the wrong drive, backed up nothing, reported
ok/0 (DIAG root cause). Now:

- discoverOffboxUnit/offboxCandidateNSRoots scan the durable storage registry
  (schedulable non-decommissioned paths ∪ systemDataPath) for backups/primary/<app>,
  independent of deploy state; newest-by-manifest-CreatedAt wins on drive churn.
- RunOffboxBackup: runOffboxInternal returns (backedUp, missing, err); 0-of-N toggled →
  hard error + operator alert; partial → ok + new OffboxTarget.LastWarning (shown on
  /backups, preserved across config edit).
- AppNamespaceRoot + primary WRITE paths unchanged.
- 6 non-hollow tests (A-E + edge) + both companion red-proofs run (reverted).
- NOT yet live-validated against the Storage Box (spike creds torn down).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01PSK5g6qYLknKj8u3QAFEr6

controller/internal/settings/settings.go

@@ -126,6 +126,9 @@ type OffboxTarget struct {
 	LastDuration  string `json:"last_duration,omitempty"`
 	RepoSizeHuman string `json:"repo_size_human,omitempty"`
 	SnapshotCount int    `json:"snapshot_count,omitempty"`
+	// LastWarning is a customer-visible notice set on an otherwise-OK run when SOME toggled apps had
+	// no discoverable recovery unit (partial run). Empty on a fully-successful or failed run.
+	LastWarning string `json:"last_warning,omitempty"`
 }
 
 // CrossDriveBackup configures per-app backup to a secondary drive.