refactor: extract app-data-backup into internal/appbackup (no behaviour change)

Extract the stateless, keep-side app-data backup primitives out of
internal/backup/ into a new self-contained internal/appbackup/ package:
- dbdump.go: DB dump discovery/execution (DiscoverDatabases, DumpOne, ...)
- appdata.go: StackDataProvider + app-data/volume discovery, HumanizeBytes
- paths.go: keep-side path helpers (AppDBDumpPath, AppVolumeDumpPath, AppDataDir)

backup/ keeps every name available via type/const aliases + one-line function
forwarders (appbackup_bridge.go), so the still-present delete-side code
(restic, cross-drive, drive-mount) and the both-side consumers (web/api/report)
compile unchanged. The keep-only consumers appexport and storage are rewired to
import appbackup directly and no longer import backup.

This is the Part-2 prerequisite for the Proxmox port: appbackup has zero
references to restic/cross-drive/drive-mount and does not import backup, so the
delete-side can later be removed without breaking app-data backup or appexport.

Behaviour-preserving: pure move + import/qualifier rewrites, no logic edits.
The four Manager methods (RunDBDumps/DumpAppVolumes/DumpAppVolumesSafe share the
delete-side mutex/status state; RestoreAppFromTier2 reads the cross-drive mirror)
intentionally stay on Manager and delegate to appbackup — for the re-platform step.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/backup/appbackup_bridge.go

@@ -0,0 +1,105 @@
+package backup
+
+// This file bridges the backup package to internal/appbackup, where the
+// self-contained app-data backup primitives (DB dump, Docker-volume archive
+// discovery, keep-side path helpers) now live. The backup package keeps these
+// names available — via type/const aliases and thin function forwarders — so
+// the (still present) delete-side code and the both-side consumers (web, api,
+// report) compile unchanged. Behaviour is identical: the forwarders call
+// straight through to appbackup.
+//
+// Go has no function aliasing, so the functions are one-line forwarders while
+// the types/consts use real aliases.
+
+import (
+	"context"
+	"log"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/appbackup"
+)
+
+// --- type aliases (appdata) ---
+
+type StackDataProvider = appbackup.StackDataProvider
+type StackSummary = appbackup.StackSummary
+type AppBackupInfo = appbackup.AppBackupInfo
+type AppDataPath = appbackup.AppDataPath
+type AppDockerVolume = appbackup.AppDockerVolume
+
+// --- type aliases (dbdump) ---
+
+type DBType = appbackup.DBType
+type DiscoveredDB = appbackup.DiscoveredDB
+type DumpResult = appbackup.DumpResult
+type DumpValidation = appbackup.DumpValidation
+type DumpFileInfo = appbackup.DumpFileInfo
+
+// --- const aliases ---
+
+const (
+	DBTypePostgres = appbackup.DBTypePostgres
+	DBTypeMariaDB  = appbackup.DBTypeMariaDB
+)
+
+// FelhomDataDir is the namespace directory on storage drives for all felhom-managed data.
+const FelhomDataDir = appbackup.FelhomDataDir
+
+// --- function forwarders (dbdump) ---
+
+func DiscoverDatabases(ctx context.Context, logger *log.Logger, debug bool) ([]DiscoveredDB, error) {
+	return appbackup.DiscoverDatabases(ctx, logger, debug)
+}
+
+func DumpAll(ctx context.Context, dbs []DiscoveredDB, dumpDir string, logger *log.Logger, debug bool) []DumpResult {
+	return appbackup.DumpAll(ctx, dbs, dumpDir, logger, debug)
+}
+
+func DumpOne(ctx context.Context, db DiscoveredDB, dumpDir string, logger *log.Logger, debug bool) DumpResult {
+	return appbackup.DumpOne(ctx, db, dumpDir, logger, debug)
+}
+
+func ValidateDump(filePath string, dbType DBType) DumpValidation {
+	return appbackup.ValidateDump(filePath, dbType)
+}
+
+func ListDumpFiles(dumpDir string) ([]DumpFileInfo, error) {
+	return appbackup.ListDumpFiles(dumpDir)
+}
+
+// --- function forwarders (appdata) ---
+
+func DiscoverAppData(provider StackDataProvider, discoveredDBs []DiscoveredDB) []AppBackupInfo {
+	return appbackup.DiscoverAppData(provider, discoveredDBs)
+}
+
+func ParseComposeNamedVolumes(composePath string) []AppDockerVolume {
+	return appbackup.ParseComposeNamedVolumes(composePath)
+}
+
+func ResolveDockerVolumeNames(composePath string) []string {
+	return appbackup.ResolveDockerVolumeNames(composePath)
+}
+
+// humanizeBytes forwards to appbackup.HumanizeBytes; kept unexported so the
+// many in-package call sites (backup.go, crossdrive.go, restore code) need no edit.
+func humanizeBytes(b int64) string {
+	return appbackup.HumanizeBytes(b)
+}
+
+// --- function forwarders (paths) ---
+
+func PrimaryBackupPath(drivePath string) string {
+	return appbackup.PrimaryBackupPath(drivePath)
+}
+
+func AppDBDumpPath(drivePath, stackName string) string {
+	return appbackup.AppDBDumpPath(drivePath, stackName)
+}
+
+func AppVolumeDumpPath(drivePath, stackName string) string {
+	return appbackup.AppVolumeDumpPath(drivePath, stackName)
+}
+
+func AppDataDir(drivePath, stackName string) string {
+	return appbackup.AppDataDir(drivePath, stackName)
+}