controller v0.242.0: a removed app is listed with its kept backup; five small ones (R-487 R-491 R-490 R-489 R-476 R-456)

R-487: the local backup lists are keyed on the drives, not on what is
deployed — a removed app whose unit was kept is listed with the restore
that reinstalls it, the picker answers for it, and the restore opens the
unit where it sits. R-491: a removal clears the app's update hold.
R-490: /api/system/info reaches the API router and reads the default
storage path. R-489: volumes_removed is the real before/after difference,
[] when none. R-476: a Tier-2 copy is dated by its data, not its manifest.
R-456: the boot-orphan rule is pinned. Every fix red-proofed.

controller/internal/backup/restore_points.go

@@ -39,6 +39,13 @@ func (m *Manager) ListRestorePoints(stackName string) (points []RestorePoint, fo
 		return nil, false
 	}
 	if _, ok := m.stackProvider.GetStackComposePath(stackName); !ok {
+		// R-487: a removed app whose backups were kept is not deployed, but its unit is on a drive
+		// and POST /backup/restore reinstalls from it. The picker used to be told 404 here while the
+		// restore itself worked — the list is keyed on the drive now, the way R-237 keyed the
+		// off-site list on the store.
+		if u, found := m.RemovedAppUnitFor(stackName); found {
+			return []RestorePoint{{Time: u.Time, ShortID: restorePointShortID, Tier: 1, DriveLabel: u.DriveLabel}}, true
+		}
 		return nil, false
 	}