controller v0.242.0: a removed app is listed with its kept backup; five small ones (R-487 R-491 R-490 R-489 R-476 R-456)

R-487: the local backup lists are keyed on the drives, not on what is
deployed — a removed app whose unit was kept is listed with the restore
that reinstalls it, the picker answers for it, and the restore opens the
unit where it sits. R-491: a removal clears the app's update hold.
R-490: /api/system/info reaches the API router and reads the default
storage path. R-489: volumes_removed is the real before/after difference,
[] when none. R-476: a Tier-2 copy is dated by its data, not its manifest.
R-456: the boot-orphan rule is pinned. Every fix red-proofed.

controller/internal/settings/settings.go

@@ -1675,6 +1675,23 @@ func (s *Settings) ClearRestoreHold(stack string) (bool, error) {
 	return true, s.save()
 }
 
+// ClearUpdateHold (R-491, v0.242.0) removes an app's hold ONLY when it is an update hold. An R-379
+// restore hold stays: that one means a database was left in an unknown state and is cleared by the
+// operator (`-clear-restore-hold`), never by a removal. Returns whether an update hold was cleared.
+func (s *Settings) ClearUpdateHold(stack string) (bool, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	h, ok := s.RestoreHolds[stack]
+	if !ok || h.Reason != HoldReasonUpdateFailed {
+		return false, nil
+	}
+	delete(s.RestoreHolds, stack)
+	if s.log != nil {
+		s.log.Printf("[INFO] [settings] update hold CLEARED for %s (the app was removed)", stack)
+	}
+	return true, s.save()
+}
+
 // SetDisconnected marks a storage path as disconnected (or connected) and records which stacks were stopped.
 func (s *Settings) SetDisconnected(path string, disconnected bool, stoppedStacks []string) error {
 	s.mu.Lock()