controller v0.121.0: backups page truth pass — remove dead Részletek card, real Tier-3 off-box state, SQLite-honest DB messaging

MinAgent: 0.81.0 (unchanged). Controller-only; no agent-API change, no backup-engine
behavior change. Fixes the self-contradicting /backups page (v0.120.0 live):

- Remove the dead "Részletek" card (redundant; kills never-set Tier2DriveGroups/
  ResticPassword fields + restic-pw element + toggleTier/toggleResticPw/copyResticPw JS).
- Per-app "3. mentés" row shows real off-box state via pure tier3State
  (unconfigured/off/escrow_pending/active) — "Hamarosan" placeholder gone.
- SQLite-honest DB messaging via pure dbSectionState (dumps/pending/embedded).
- Populate Tier1LastRun/Tier1LastStatus from ListRestorePoints; Tier-1/Tier-2 labels
  via timeAgoStr (relative), confirm() dialog keeps raw timestamp.
- Terminology split: "Távoli mentés (3. mentés)" (off-box, +#offbox-section anchor)
  vs "Távoli rendszermentés" (PBS whole-CT).
- Deploy page: add "Mentési beállítások →" link.

+9 internal/web tests (pure helper tables + buildAppBackupRows wiring + template
renders), 4 companion red-proofs run→fail→revert.

CHANGELOG.md

@@ -1,5 +1,44 @@
 ## Changelog
 
+### v0.121.0 — backups page truth pass (dead sections removed, real Tier-3 state, SQLite-honest DB) (2026-07-12) — MinAgent: 0.81.0
+
+Pure UI/data-plumbing on `/backups`; no backup-engine behavior change, no agent-API change, MinAgent
+UNCHANGED (0.81.0). The live demo page (v0.120.0) contradicted itself — a dead "Részletek" card
+claimed "Nincs 2. szintű mentés konfigurálva" while six Tier-2 runs showed above it; every per-app
+"3. mentés" row said "Hamarosan — B2/S3/SFTP" while the off-box (Storage Box) tier was live with 6
+snapshots; and an embedded-SQLite-only box rendered "Adatbázis mentve: 0" / "Nem található adatbázis
+mentés." as if backups were failing.
+
+- **Dead "Részletek" card removed** (operator-approved as redundant — per-app rows + the Adatbázisok
+  section already carry the truth). This deletes the last references to the never-set template fields
+  `Tier2DriveGroups` and `ResticPassword`, the `restic-pw` element, and the `toggleTier` /
+  `toggleResticPw` / `copyResticPw` JS.
+- **Per-app "3. mentés" row now shows real off-box state** — a four-state row driven by a new pure
+  `tier3State` (configured → toggle → escrow precedence): `unconfigured` ("Nincs beállítva" +
+  Beállítás link), `off` ("Kikapcsolva" + Bekapcsolás link → `#offbox-section`), `escrow_pending`
+  ("Kulcsletétre vár" — never a false success while the fork-4 escrow gate holds), `active` (status
+  badge from the global off-box `LastStatus`, `restic → <host>`, relative last-run). The "hamarosan"
+  placeholder is gone everywhere.
+- **SQLite-honest DB messaging** — a new pure `dbSectionState(discovered, dumps)` picks
+  `dumps` / `pending` / `embedded`. Embedded-only boxes now render "–" + "beágyazott DB-k a
+  kötetmentésben" on the stat card and an explanation ("…beágyazott adatbázist használnak (pl.
+  SQLite)…") instead of a bare "0" / "Nem található adatbázis mentés."; a discovered-but-not-yet-dumped
+  box shows "…az első ütemezett mentés éjjel fut le."
+- **Three dead/raw display fields fixed** — `Tier1LastRun`/`Tier1LastStatus` (previously never
+  assigned) are now populated from `ListRestorePoints` (newest recovery-unit artifact time; correct
+  per-drive resolution — no fabricated time for unit-less apps); Tier-1 and Tier-2 last-run labels
+  now render via `timeAgoStr` (relative time) instead of raw RFC3339 (the restore confirm() dialog
+  keeps the precise timestamp by design).
+- **Terminology split** — the off-box section is retitled "Távoli mentés (3. mentés) — titkosított,
+  offsite" (with an `#offbox-section` anchor); the whole-guest PBS stat card is relabeled "Távoli
+  rendszermentés" so two different features no longer share one customer-facing name on one page.
+- **Deploy page** — the app backup card gains a "Mentési beállítások →" link to the tier-2 config panel.
+- **Tests:** +9 in `internal/web` (pure `dbSectionState`/`tier3State` truth tables; `buildAppBackupRows`
+  off-box mapping + escrow-pending precedence + Tier-1-from-restore-points wiring; template renders for
+  all four Tier-3 states, embedded/pending DB messaging, and relative-time formatting). Four companion
+  red-proofs run→fail→revert (re-insert "hamarosan"; hardcode OffboxEnabled=false; dbSectionState
+  ignores discovered; drop the Tier1LastRun assignment).
+
 ### v0.120.0 — dead-app alerting (fix-3) + debug-ring revision (fix-6) — CLOSES CAMPAIGN-3 (2026-07-12) — MinAgent: 0.81.0
 
 The last CAMPAIGN-3 findings (`felhom.eu/documentation/audits/CAMPAIGN-3-2026-07-11.md`). MinAgent