.fab exclusion scoping: classes in the manual export (Task 4, v0.136.0)

SQ6 over-capture FIXED for classified apps: the userdata root tar is exclude-scoped (keeps only
ancestors/descendants of a SELECTED bind relpath — R1-C, the tier2Reconcile keep-rule); no selected
userdata bind → no root tar (radarr state-only). New appbackup.ComputeFabBuckets (shared
resolveGuardCollapse pipeline; class buckets; guards over ALL classes; no cross-bucket containment).
appexport/fabplan.go: computeFabPlan + tarDirectoryExcluding + fabEstimateSplit. ExportRequest gains
DeselectOptional/OptInExcluded (both start handlers — two-call-site); mandatory is a server-side
floor. Manifest v1 + import UNTOUCHED; legacy apps byte-identical to v0.130.0. Estimate additive
class split; export UI: locked-mandatory/optional-checkboxes/excluded-opt-in + two-number warning.
All 6 §10 red-proofs verified. 6D Accept #1 now runs against this shape.

controller/cmd/controller/main.go

@@ -1353,6 +1353,12 @@ func (a *exportAdapter) GetStackDir(name string) (string, bool) {
 	return filepath.Dir(s.ComposePath), true
 }
 
+// GetStackClassifiedBinds delegates to the stacks manager's backup-classification resolver (Task 2),
+// used by the `.fab` class-scoped export plan (Task 4).
+func (a *exportAdapter) GetStackClassifiedBinds(name string) ([]appbackup.ClassifiedBind, bool) {
+	return a.mgr.ClassifiedBinds(name)
+}
+
 func (a *exportAdapter) GetStackComposePath(name string) (string, bool) {
 	s, ok := a.mgr.GetStack(name)
 	if !ok {