controller v0.121.0: backups page truth pass — remove dead Részletek card, real Tier-3 off-box state, SQLite-honest DB messaging

MinAgent: 0.81.0 (unchanged). Controller-only; no agent-API change, no backup-engine
behavior change. Fixes the self-contradicting /backups page (v0.120.0 live):

- Remove the dead "Részletek" card (redundant; kills never-set Tier2DriveGroups/
  ResticPassword fields + restic-pw element + toggleTier/toggleResticPw/copyResticPw JS).
- Per-app "3. mentés" row shows real off-box state via pure tier3State
  (unconfigured/off/escrow_pending/active) — "Hamarosan" placeholder gone.
- SQLite-honest DB messaging via pure dbSectionState (dumps/pending/embedded).
- Populate Tier1LastRun/Tier1LastStatus from ListRestorePoints; Tier-1/Tier-2 labels
  via timeAgoStr (relative), confirm() dialog keeps raw timestamp.
- Terminology split: "Távoli mentés (3. mentés)" (off-box, +#offbox-section anchor)
  vs "Távoli rendszermentés" (PBS whole-CT).
- Deploy page: add "Mentési beállítások →" link.

+9 internal/web tests (pure helper tables + buildAppBackupRows wiring + template
renders), 4 companion red-proofs run→fail→revert.

controller/README.md

@@ -628,10 +628,15 @@ data back up config + DB + user data + Docker volumes; apps without HDD back up
 
 **Protects against:** primary drive failure, drive theft/damage.
 
-#### Tier 3: Remote Backup (future)
+#### Tier 3: Off-box (NAS) Backup — live
 
-Complete offsite backup for disaster recovery. Not yet implemented.
-Placeholder shown in UI ("3. mentés — Hamarosan").
+The off-site "1" of 3-2-1: each off-box-toggled app's recovery unit + DB dumps + volume tars are
+backed up to the customer's NAS / Felhom offsite as an encrypted restic repo over SFTP (see the
+off-box section below and `internal/backup/offbox.go`). The per-app "3. mentés" row on the backups
+page renders one of four real states via the pure `tier3State` helper (`internal/web/backup_page_state.go`):
+`unconfigured` (no target) / `off` (app not toggled) / `escrow_pending` (fork-4 key-escrow gate holds —
+never a false success) / `active` (status badge + `restic → <host>` + relative last-run). Off-box run
+status is repo-global (one `LastRun`); no per-app run time is fabricated.
 
 #### Restore (`internal/backup/restore.go`)
 
@@ -697,7 +702,9 @@ Every app starts as yellow (1 tier only). Green requires Tier 2 configured with
 - **2. mentes** (Tier 2, configurable for ALL apps) — one of:
   - Configured: method (rsync/restic) + destination + schedule + last run + status + contents + browsable indicator (folder icon for rsync) + action buttons
   - Not configured: "1. mentes auto" + "Nincs 2. masolat" + settings link
-- **3. mentes** (Tier 3, placeholder) — grayed out "Hamarosan" + "tavoli (offsite)" + future note
+- **3. mentes** (Tier 3, off-box/NAS — live) — one of four `tier3State` states: `unconfigured`
+  ("Nincs beallitva" + Beallitas link), `off` ("Kikapcsolva" + Bekapcsolas link), `escrow_pending`
+  ("Kulcsletetre var"), `active` (status badge + "restic -> <host>" + relative last-run)
 
 **Backup contents per app** (shown per tier):
 - Apps with DB + HDD: "DB + Konfig + Adatok"