.fab exclusion scoping: classes in the manual export (Task 4, v0.136.0)

SQ6 over-capture FIXED for classified apps: the userdata root tar is exclude-scoped (keeps only
ancestors/descendants of a SELECTED bind relpath — R1-C, the tier2Reconcile keep-rule); no selected
userdata bind → no root tar (radarr state-only). New appbackup.ComputeFabBuckets (shared
resolveGuardCollapse pipeline; class buckets; guards over ALL classes; no cross-bucket containment).
appexport/fabplan.go: computeFabPlan + tarDirectoryExcluding + fabEstimateSplit. ExportRequest gains
DeselectOptional/OptInExcluded (both start handlers — two-call-site); mandatory is a server-side
floor. Manifest v1 + import UNTOUCHED; legacy apps byte-identical to v0.130.0. Estimate additive
class split; export UI: locked-mandatory/optional-checkboxes/excluded-opt-in + two-number warning.
All 6 §10 red-proofs verified. 6D Accept #1 now runs against this shape.

controller/internal/appexport/provider.go

@@ -4,6 +4,8 @@
 // the app to its current state.
 package appexport
 
+import "gitea.dooplex.hu/admin/felhom-controller/internal/appbackup"
+
 // ExportStackProvider provides stack data without circular imports.
 // Implemented by exportAdapter in main.go (same pattern as backup.StackDataProvider).
 type ExportStackProvider interface {
@@ -15,6 +17,10 @@ type ExportStackProvider interface {
 	GetStackHDDMounts(name string) []string
 	// GetStackHDDPath returns the raw HDD_PATH env var from app.yaml.
 	GetStackHDDPath(name string) string
+	// GetStackClassifiedBinds returns the app's backup-classified compose binds + whether it carries a
+	// (valid) backup block (Task 2). Drives the `.fab` class-scoped export plan (Task 4); a legacy app
+	// (false) exports the v0.130.0 full-root capture unchanged.
+	GetStackClassifiedBinds(name string) ([]appbackup.ClassifiedBind, bool)
 	// IsStackRunning returns true if the stack has running containers.
 	IsStackRunning(name string) bool
 	// StopStack stops the stack via docker compose down.