.fab exclusion scoping: classes in the manual export (Task 4, v0.136.0)

SQ6 over-capture FIXED for classified apps: the userdata root tar is exclude-scoped (keeps only
ancestors/descendants of a SELECTED bind relpath — R1-C, the tier2Reconcile keep-rule); no selected
userdata bind → no root tar (radarr state-only). New appbackup.ComputeFabBuckets (shared
resolveGuardCollapse pipeline; class buckets; guards over ALL classes; no cross-bucket containment).
appexport/fabplan.go: computeFabPlan + tarDirectoryExcluding + fabEstimateSplit. ExportRequest gains
DeselectOptional/OptInExcluded (both start handlers — two-call-site); mandatory is a server-side
floor. Manifest v1 + import UNTOUCHED; legacy apps byte-identical to v0.130.0. Estimate additive
class split; export UI: locked-mandatory/optional-checkboxes/excluded-opt-in + two-number warning.
All 6 §10 red-proofs verified. 6D Accept #1 now runs against this shape.

controller/internal/appexport/roundtrip_test.go

@@ -1,6 +1,7 @@
 package appexport
 
 import (
+	"gitea.dooplex.hu/admin/felhom-controller/internal/appbackup"
 	"io"
 	"log"
 	"os"
@@ -36,6 +37,9 @@ func (p *rtProvider) GetStackComposePath(string) (string, bool) {
 }
 func (p *rtProvider) GetStackHDDMounts(string) []string          { return nil }
 func (p *rtProvider) GetStackHDDPath(string) string              { return "" }
+func (p *rtProvider) GetStackClassifiedBinds(string) ([]appbackup.ClassifiedBind, bool) {
+	return nil, false
+}
 func (p *rtProvider) IsStackRunning(string) bool                 { return p.running }
 func (p *rtProvider) StopStack(string) error                     { p.stopped++; return nil }
 func (p *rtProvider) StartStack(string) error                    { p.started = true; return nil }