.fab exclusion scoping: classes in the manual export (Task 4, v0.136.0)

SQ6 over-capture FIXED for classified apps: the userdata root tar is exclude-scoped (keeps only
ancestors/descendants of a SELECTED bind relpath — R1-C, the tier2Reconcile keep-rule); no selected
userdata bind → no root tar (radarr state-only). New appbackup.ComputeFabBuckets (shared
resolveGuardCollapse pipeline; class buckets; guards over ALL classes; no cross-bucket containment).
appexport/fabplan.go: computeFabPlan + tarDirectoryExcluding + fabEstimateSplit. ExportRequest gains
DeselectOptional/OptInExcluded (both start handlers — two-call-site); mandatory is a server-side
floor. Manifest v1 + import UNTOUCHED; legacy apps byte-identical to v0.130.0. Estimate additive
class split; export UI: locked-mandatory/optional-checkboxes/excluded-opt-in + two-number warning.
All 6 §10 red-proofs verified. 6D Accept #1 now runs against this shape.

controller/internal/appexport/estimate_volsize_test.go

@@ -6,19 +6,26 @@ import (
 	"log"
 	"strings"
 	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/appbackup"
 )
 
 // hddProvider is an rtProvider that reports an HDD-backed stack (estimate scenario H + the
 // v0.130.0 additive-export tests in export_additive_test.go).
 type hddProvider struct {
 	*rtProvider
-	mounts  []string
-	hddPath string
+	mounts   []string
+	hddPath  string
+	binds    []appbackup.ClassifiedBind
+	hasBinds bool
 }
 
 func (p *hddProvider) GetStackNeedsHDD(string) bool      { return true }
 func (p *hddProvider) GetStackHDDMounts(string) []string { return p.mounts }
 func (p *hddProvider) GetStackHDDPath(string) string     { return p.hddPath }
+func (p *hddProvider) GetStackClassifiedBinds(string) ([]appbackup.ClassifiedBind, bool) {
+	return p.binds, p.hasBinds
+}
 
 func newEstimator(t *testing.T, provider ExportStackProvider) *Exporter {
 	t.Helper()