controller v0.242.0: a removed app is listed with its kept backup; five small ones (R-487 R-491 R-490 R-489 R-476 R-456)

R-487: the local backup lists are keyed on the drives, not on what is
deployed — a removed app whose unit was kept is listed with the restore
that reinstalls it, the picker answers for it, and the restore opens the
unit where it sits. R-491: a removal clears the app's update hold.
R-490: /api/system/info reaches the API router and reads the default
storage path. R-489: volumes_removed is the real before/after difference,
[] when none. R-476: a Tier-2 copy is dated by its data, not its manifest.
R-456: the boot-orphan rule is pinned. Every fix red-proofed.

controller/scripts/retrieval_promise_gate.py

@@ -56,6 +56,11 @@ ALLOWLIST = {
     ("backups.html", "amelyből az egész készülék visszaállítható"):
         "the LOCAL whole-device backup, made and held by the host agent. Nothing to do with the "
         "off-site escrow claim — no recovery code is involved.",
+    ("backups_apps.html", "Eltávolítva — visszaállítható"):
+        "R-487: a REMOVED app's kept recovery unit. The row renders only when the unit's manifest "
+        "is readable on a CONNECTED registered drive (backup.ListRemovedAppUnits), and the claim is "
+        "the very action beside it — POST /backup/restore from that unit. No recovery code, no "
+        "off-site store: what the box can see on its own disk.",
     ("backups_apps.html", "alkalmazásonként visszaállítható"):
         "per-app restore from the local app-data backup. Same: local, no recovery code.",
     ("backups_remote.html", "mentéseid visszaszerezhetők.</strong>"):