controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

R-486 (P1): removing an app with its backups KEPT keeps its Tier-2 record,
so the second-drive restore is no longer refused over an intact mirror.
R-484: postgis/pgvector/timescaledb images are Postgres (logical dumps).
R-485: the backup card sizes the recovery unit and the mirror(s).
R-480: a held update's sentence leaves the card once the hold is lifted.
R-477: the update's off-site lookup is one snapshots call, no stats.
R-478: a copy older than this install's deploy does not count.
R-474: "delete backups" deletes the unit, the mirror(s) and the prefs.

Tests and red-proofs per row; evidence in felhom.eu
documentation/audits/v0240-2026-09-13/ and nightly-2026-09-13-adventurelog/.

controller/internal/backup/backup.go

@@ -174,11 +174,11 @@ type Manager struct {
 	updatingCheck func(stackName string) bool
 
 	// R-475 update-precondition seams, one per tier. Nil → the real Tier2UnitRestorePoint /
-	// ListRestorePoints / OffsiteInventoryList. They let a test reach Tier 1 and Tier 3 without a drive
+	// ListRestorePoints / OffsiteSnapshotTimes. They let a test reach Tier 1 and Tier 3 without a drive
 	// or a restic repository; see UpdateRestorePoints.
-	updateTier2PointFn  func(stackName string) (Tier2RestorePoint, error)
-	updateTier1PointsFn func(stackName string) ([]RestorePoint, bool)
-	updateOffsiteInvFn  func(ctx context.Context) (OffsiteInventory, error)
+	updateTier2PointFn   func(stackName string) (Tier2RestorePoint, error)
+	updateTier1PointsFn  func(stackName string) ([]RestorePoint, bool)
+	updateOffsiteTimesFn func(ctx context.Context) (map[string]time.Time, error)
 
 	// R-354 volume-REPLAY seam — the mirror of the F17 DB seams above, so the off-site path's new
 	// volume leg is unit-testable without Docker. Nil → the real restoreDockerVolumesFrom.