controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

R-486 (P1): removing an app with its backups KEPT keeps its Tier-2 record,
so the second-drive restore is no longer refused over an intact mirror.
R-484: postgis/pgvector/timescaledb images are Postgres (logical dumps).
R-485: the backup card sizes the recovery unit and the mirror(s).
R-480: a held update's sentence leaves the card once the hold is lifted.
R-477: the update's off-site lookup is one snapshots call, no stats.
R-478: a copy older than this install's deploy does not count.
R-474: "delete backups" deletes the unit, the mirror(s) and the prefs.

Tests and red-proofs per row; evidence in felhom.eu
documentation/audits/v0240-2026-09-13/ and nightly-2026-09-13-adventurelog/.

controller/internal/settings/settings.go

@@ -1142,6 +1142,19 @@ func (s *Settings) SetAppOffbox(stackName string, on bool) error {
 	return s.save()
 }
 
+// DeleteAppBackupPrefs (R-474, v0.240.0) forgets every per-app backup preference of an app whose
+// backups the customer asked to delete on removal — the off-site toggle and the cross-drive record
+// together. Before it, "delete backups" left `app_backup[<app>]` behind, and a reinstall inherited it.
+func (s *Settings) DeleteAppBackupPrefs(stackName string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	if _, ok := s.AppBackup[stackName]; !ok {
+		return nil
+	}
+	delete(s.AppBackup, stackName)
+	return s.save()
+}
+
 // GetOffboxApps returns the stack names toggled for off-box backup.
 func (s *Settings) GetOffboxApps() []string {
 	s.mu.RLock()