controller v0.240.0: seven defects from the any-tier proof and the first nightly rotation

R-486 (P1): removing an app with its backups KEPT keeps its Tier-2 record,
so the second-drive restore is no longer refused over an intact mirror.
R-484: postgis/pgvector/timescaledb images are Postgres (logical dumps).
R-485: the backup card sizes the recovery unit and the mirror(s).
R-480: a held update's sentence leaves the card once the hold is lifted.
R-477: the update's off-site lookup is one snapshots call, no stats.
R-478: a copy older than this install's deploy does not count.
R-474: "delete backups" deletes the unit, the mirror(s) and the prefs.

Tests and red-proofs per row; evidence in felhom.eu
documentation/audits/v0240-2026-09-13/ and nightly-2026-09-13-adventurelog/.

controller/internal/stacks/manager.go

@@ -149,6 +149,9 @@ type Stack struct {
 	UpdatePhase      string `json:"update_phase,omitempty"`
 	UpdatePhaseLabel string `json:"update_phase_label,omitempty"`
 	UpdateError      string `json:"update_error,omitempty"`
+	// updateHeld (R-480, v0.240.0) — the last update ended HELD, so UpdateError is the hold's own
+	// sentence („… leállítva marad"). It is shown only while that hold is in force; fillHoldReason.
+	updateHeld bool
 	// HoldReason is the customer sentence of a hold in force on this app (a failed update or a failed
 	// restore), "" when none. Filled on every read from the ONE hold store, never cached, so the page
 	// and the API cannot show a hold the gate has already lifted — or miss one it enforces.