controller v0.239.0: any backup tier lets an app update (R-475)

Operator ruling 2026-09-13. The update precondition walks Tier 2, Tier 1
(own recovery unit, "helyi") and Tier 3 (off-site, 15 s bound; unreachable
counts as absent with a WARN) and leans on the first FRESH copy; the
backup_max_age rule applies to whichever tier is chosen. No copy anywhere:
back up first. Refused only when nothing exists and no backup can be taken.
RunAppBackupNow tolerates a Tier-2 failure (WARN) and marks the captured
unit proven current. The hold names the tier (második meghajtó / saját
meghajtó / távoli mentés) and the date; pre-v0.239.0 holds keep their text.
A successful off-site restore now lifts an update hold. The backups page
still uses Tier2UnitRestorePoint unchanged.

Scenarios G-M tested; red-proofs M, L, the tail and the off-site clear in
felhom.eu documentation/audits/rulings-r472-r475-2026-09-13/.

controller/internal/backup/backup.go

@@ -173,6 +173,13 @@ type Manager struct {
 	// updatingCheck (slice 4) — nil-safe; see isHeld / SetUpdatingCheck.
 	updatingCheck func(stackName string) bool
 
+	// R-475 update-precondition seams, one per tier. Nil → the real Tier2UnitRestorePoint /
+	// ListRestorePoints / OffsiteInventoryList. They let a test reach Tier 1 and Tier 3 without a drive
+	// or a restic repository; see UpdateRestorePoints.
+	updateTier2PointFn  func(stackName string) (Tier2RestorePoint, error)
+	updateTier1PointsFn func(stackName string) ([]RestorePoint, bool)
+	updateOffsiteInvFn  func(ctx context.Context) (OffsiteInventory, error)
+
 	// R-354 volume-REPLAY seam — the mirror of the F17 DB seams above, so the off-site path's new
 	// volume leg is unit-testable without Docker. Nil → the real restoreDockerVolumesFrom.
 	volumeReplayFrom func(stackName, dumpDir string) (int, error)