controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

R-486 (P1): removing an app with its backups KEPT keeps its Tier-2 record,
so the second-drive restore is no longer refused over an intact mirror.
R-484: postgis/pgvector/timescaledb images are Postgres (logical dumps).
R-485: the backup card sizes the recovery unit and the mirror(s).
R-480: a held update's sentence leaves the card once the hold is lifted.
R-477: the update's off-site lookup is one snapshots call, no stats.
R-478: a copy older than this install's deploy does not count.
R-474: "delete backups" deletes the unit, the mirror(s) and the prefs.

Tests and red-proofs per row; evidence in felhom.eu
documentation/audits/v0240-2026-09-13/ and nightly-2026-09-13-adventurelog/.

controller/internal/appbackup/dbservices.go

@@ -30,7 +30,10 @@ import (
 func dbTypeForImage(image string) (DBType, bool) {
 	img := strings.ToLower(image)
 	switch {
-	case strings.Contains(img, "postgres"):
+	// R-484 (v0.240.0): derived Postgres images whose name does not carry "postgres". Measured on
+	// demo-hp 2026-09-13: adventurelog's `postgis/postgis:16-3.5-alpine` was "not a database", so
+	// the app got no logical dump anywhere. Same pg_dump, same PG* credentials.
+	case strings.Contains(img, "postgres"), strings.Contains(img, "postgis"), strings.Contains(img, "pgvector"), strings.Contains(img, "timescaledb"):
 		return DBTypePostgres, true
 	case strings.Contains(img, "mariadb"), strings.Contains(img, "mysql"):
 		return DBTypeMariaDB, true

controller/internal/appbackup/dbservices_test.go

@@ -41,6 +41,10 @@ func TestDBTypeForImage(t *testing.T) {
 		// immich's real pin — a vector-extended postgres whose REPO segment carries the substring.
 		{"ghcr.io/immich-app/postgres:16-vectorchord0.4.3-pgvectors0.2.0", DBTypePostgres, true},
 		{"postgres", DBTypePostgres, true},
+		// R-484: adventurelog's real pin — no "postgres" substring anywhere in the reference.
+		{"postgis/postgis:16-3.5-alpine", DBTypePostgres, true},
+		{"pgvector/pgvector:pg16", DBTypePostgres, true},
+		{"timescale/timescaledb:2.17.0-pg16", DBTypePostgres, true},
 		{"POSTGRES:16", DBTypePostgres, true}, // the discovery path lowercases; so does this
 		{"mariadb:11", DBTypeMariaDB, true},
 		{"mysql:8.4", DBTypeMariaDB, true},