.fab exclusion scoping: classes in the manual export (Task 4, v0.136.0)

SQ6 over-capture FIXED for classified apps: the userdata root tar is exclude-scoped (keeps only
ancestors/descendants of a SELECTED bind relpath — R1-C, the tier2Reconcile keep-rule); no selected
userdata bind → no root tar (radarr state-only). New appbackup.ComputeFabBuckets (shared
resolveGuardCollapse pipeline; class buckets; guards over ALL classes; no cross-bucket containment).
appexport/fabplan.go: computeFabPlan + tarDirectoryExcluding + fabEstimateSplit. ExportRequest gains
DeselectOptional/OptInExcluded (both start handlers — two-call-site); mandatory is a server-side
floor. Manifest v1 + import UNTOUCHED; legacy apps byte-identical to v0.130.0. Estimate additive
class split; export UI: locked-mandatory/optional-checkboxes/excluded-opt-in + two-number warning.
All 6 §10 red-proofs verified. 6D Accept #1 now runs against this shape.

controller/internal/web/handler_export.go

@@ -168,10 +168,12 @@ func (s *Server) apiExportStart(w http.ResponseWriter, r *http.Request) {
 	}
 
 	var req struct {
-		StackName string `json:"stack_name"`
-		DestDrive string `json:"dest_drive"`
-		Password  string `json:"password"`
-		StopApp   bool   `json:"stop_app"`
+		StackName        string   `json:"stack_name"`
+		DestDrive        string   `json:"dest_drive"`
+		Password         string   `json:"password"`
+		StopApp          bool     `json:"stop_app"`
+		DeselectOptional []string `json:"deselect_optional"` // Task 4: `.fab` class selection
+		OptInExcluded    []string `json:"opt_in_excluded"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		s.logger.Printf("[DEBUG] [web] apiExportStart: invalid body: %v", err)
@@ -199,10 +201,12 @@ func (s *Server) apiExportStart(w http.ResponseWriter, r *http.Request) {
 	}
 
 	err := s.appExporter.StartExport(appexport.ExportRequest{
-		StackName: req.StackName,
-		DestDrive: req.DestDrive,
-		Password:  req.Password,
-		StopApp:   req.StopApp,
+		StackName:        req.StackName,
+		DestDrive:        req.DestDrive,
+		Password:         req.Password,
+		StopApp:          req.StopApp,
+		DeselectOptional: req.DeselectOptional,
+		OptInExcluded:    req.OptInExcluded,
 	})
 	if err != nil {
 		s.logger.Printf("[ERROR] [web] Export start failed for %s: %v", req.StackName, err)