v0.164.0: deliberately stopped apps no longer alarm (banner + email)

A UI stop (Leallitas -> compose down -> StateStopped) is the user's own
action, not a fault, and must not raise the deadapp banner OR the
app_start_failed event. Filter at the single fix-3 derivation point:
extract scanDeployedAppRunStates's pure core to classifyRunStates and
change the down predicate to IsDownState(st.State) && st.State !=
StateStopped. Suppresses StateStopped from both the banner dead-list and
the notifier Down-set at once.

Rests on two invariants (recorded at the seam, README, CONTEXT):
 I1 StopStack = compose down => zero containers => StateStopped
 I2 P2 census: all catalog services unless-stopped => faults never rest
    at stopped (they surface as exited/degraded).
IsDownState unchanged; out-of-band 'compose stop' (containers remain ->
exited) still alerts. Tests +4 (notify 3->4, main 4->7), both red-proofs
verified. No template/funcmap/notifier/counter/copy change.

controller/README.md

@@ -1624,8 +1624,9 @@ Each event carries typed detail structs (e.g., `BackupDetails`, `DiskDetails`, `
 
 **Deployed-app-down alerting (fix-3, v0.120.0, CAMPAIGN-3).** A `deadapp-check` scheduler job (every
 30 s, after a 90 s boot grace) scans `stackMgr.GetStacks()`: a DEPLOYED app whose containers are
-`stopped`/`exited` (`stacks.IsDownState` — a Docker `created`/`dead` container, the F11 dead-at-boot
-case, resolves to `stopped`) gets a **state-based WARN dashboard banner** ("Telepített alkalmazás nem
+`exited`/`degraded` (`stacks.IsDownState` minus the `stopped` exclusion added in v0.164.0 — see below;
+a Docker `created`/`dead` container, the F11 dead-at-boot case, resolves to `exited`) gets a
+**state-based WARN dashboard banner** ("Telepített alkalmazás nem
 fut: <app>", grouped above 3 so a reboot storm doesn't wall the dashboard) that self-clears when the
 app runs again, AND an `app_start_failed` hub event fired **once per running→down transition**
 (`Notifier.NotifyAppStartFailures` tracks per-app state; down→down cycles are silent — the hub owns
@@ -1648,6 +1649,21 @@ colour, counted with the stopped apps, URL flagged unpublished (Traefik withhold
 routed member is the dead one). Policy reads are one `docker inspect` per down member of a mixed
 stack, cached per container+state.
 
+**Deliberate stops are silent (v0.164.0).** Stopping an app from the UI (Leállítás → `StopStack` →
+`docker compose down` → zero containers → the deployed stack aggregates to `StateStopped`) is the
+user's own action, not a fault, and must not raise the banner OR the `app_start_failed` email. The
+scan's pure core was extracted to `classifyRunStates([]stacks.Stack)` and its down predicate is now
+`stacks.IsDownState(st.State) && st.State != stacks.StateStopped` — the SINGLE fix-3 derivation point,
+so `StateStopped` is dropped from both the banner dead-list and the notifier Down-set at once (the
+launcher tile still shows greyed „Leállítva"; the monitoring page and dashboard counters are factual
+display, not alarms, and are unchanged). This rests on two invariants: **I1** — a UI stop always ends
+at `StateStopped` (compose down removes the containers); **I2** — the P2 restart-policy census
+(53 templates / 78 services, all `unless-stopped`) means a crashing app never comes to rest at
+`stopped`, so faults still surface as `exited`/`degraded`/`restarting`/`unhealthy`. If either
+invariant changes, revisit the suppression. `IsDownState` itself is deliberately UNCHANGED (other
+callers rely on stopped counting as down). An out-of-band `docker compose stop` leaves the containers
+present → `StateExited` → still alerts, which is correct (out-of-band tampering is reportable).
+
 **Boot desired-state reconciliation (R-52, v0.156.0, `internal/bootrecon`).** A `deployed: true` app
 that missed its boot start used to stay down until a human noticed — the same shutdown that produced
 F4 left immich and calibre-web `Exited` while ten sibling containers came back, and they were still