v0.55.0: Phase 3 — auto off-drive Tier 2 (rootfs-headroom guard)

Tier 2 rsync-mirrors each HDD app's recovery unit + appdata to a DIFFERENT physical
disk (the only off-drive protection bind-mounted userdata can get; PBS can't reach it).
Auto-enabled, auto-target: prefer another registered drive (different physical disk via
system.SamePhysicalDevice), else the internal SSD for SMALL units only — with a
size-aware headroom guard that REFUSES rather than fill the ~8G guest rootfs, recording
an honest "needs 2nd HDD" status. Status persisted via the surviving CrossDriveBackup;
"2. mentés" UI card now populated. Daily tier2-backup job + POST /api/backup/tier2.

- backup/tier2.go (engine+selection+headroom), tier2_test.go (headroom arithmetic)
- system.SamePhysicalDevice (linux Stat_t.Dev + stub)
- handlers.go Tier2 UI population + tier2DestLabel; backups.html honest no-target reason
- fixed stale TestBackupCopiesOnPath (old felhom-data layout -> in-guest layout)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/cmd/controller/main.go

@@ -341,6 +341,26 @@ func main() {
 			backupMgr.RefreshCache(nextDBDump)
 			return nil
 		})
+
+		// Tier 2: off-drive copy of each HDD app's recovery unit + userdata (auto-enabled, auto-target).
+		// Runs after the DB dump so it copies a fresh unit.
+		backupMgr.SetTier2Notifier(func(stackName, destLabel string, dur time.Duration, err error) {
+			if err != nil {
+				notifier.NotifyCrossDriveFailed(notify.CrossDriveDetails{
+					StackName: stackName, Method: "rsync", DestPath: destLabel,
+					Duration: dur.Round(time.Second).String(), Error: err.Error(),
+				})
+			} else {
+				notifier.NotifyCrossDriveCompleted(notify.CrossDriveDetails{
+					StackName: stackName, Method: "rsync", DestPath: destLabel,
+					Duration: dur.Round(time.Second).String(),
+				})
+			}
+		})
+		sched.Daily("tier2-backup", "03:30", func(ctx context.Context) error {
+			backupMgr.RunAllTier2()
+			return nil
+		})
 	}
 
 	// Metrics prune — daily at 04:00