B1: data-migration engine (MigrateAll + MigrateApp) + backup mutual-exclusion

internal/stacks/migrate.go: crash-safe, resumable namespace migration over the
controller's /mnt RW mount. Two entry points (whole-namespace + per-app) share one
journaled pipeline: validate -> stop -> copy (rsync -a --checksum, additive; conflict-
merge walk for non-app content) -> verify -> flip+redeploy (RedeployFromEnv) -> cleanup.
CLEANUP (the only destructive step) is gated on all units verified AND all apps
redeployed. Single-flight; mutual exclusion with the backup orchestrator (Change 3).
Non-hollow tests incl. mutation-proven collision + cleanup-gate companions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/stacks/manager.go

@@ -15,6 +15,7 @@ import (
 
 	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
 	"gitea.dooplex.hu/admin/felhom-controller/internal/crypto"
+	"gitea.dooplex.hu/admin/felhom-controller/internal/settings"
 )
 
 // ContainerState represents the current state of a container.
@@ -85,6 +86,15 @@ type Manager struct {
 	mu         sync.RWMutex
 	encKey     []byte     // AES-256 key for encrypting sensitive values in app.yaml
 	infraMu    sync.Mutex // single-flight guard for EnsureBaseStack (base-infra bring-up/self-heal)
+
+	// Migration engine (B1): single-flight + live job + deps wired via SetMigrationDeps.
+	migrateMu     sync.Mutex
+	migrating     bool
+	migJob        *MigrationJob
+	settings      *settings.Settings
+	sysDataPath   string
+	backupRunning func() bool // mutual exclusion with the backup orchestrator (Change 3)
+	testSeams     *migSeams   // nil in production; tests inject fakes
 }
 
 // NewManager creates a new stack manager.