R-331 (controller half): forward stats_known so the hub can tell empty from unmeasured (v0.225.0)

The hub's operator Backup card read `Snapshots 0 / Repo Size 0 MB / Integrity
Unknown` for EVERY customer, because it rendered the report's `backup` object --
whose snapshot/size/integrity fields have had NO producer since disk-tier restic
moved to the host agent (slice 8C). buildBackupReport leaves them zero
deliberately and says so. Measured on demo-hp 2026-08-30 while that night's log
said `[offbox] backup OK: 8 app(s) backed up, 67 snapshot(s), 2m14s`.

The live numbers were always in the report's `offsite` object, which the hub
already reads for its Offsite page and its fill/staleness alarms. The hub fix is
to render that -- and that made exactly ONE field mandatory that was not being
forwarded.

snapshot_count:0 means two opposite things: "holds nothing" and "never
measured". R-225 measured that confusion inside this repo (a rebuilt box
rendered 0 pillanatkep over a store really holding snapshot f3d9cd67), and
settings.OffboxTarget.StatsKnown fixed it for the controller's own UI. It was
never put on the wire, so the hub was free to make the identical mistake one
layer up -- and did. OffboxReportStatus.StatsKnown now carries it, omitempty, so
an older controller sends no key and a reader degrades to UNKNOWN, never to
EMPTY. Absence is ignorance, not emptiness.

The four dead BackupReport fields stay on the wire (historical reports in the
hub store must keep parsing) but now carry a warning naming R-331 and pointing
at Offsite. TestBackupReport_DeadFieldsStayZero fails the moment a producer
appears for one -- the prompt to update the hub card in the SAME change rather
than ship a field nothing renders.

RED-PROOF: drop `StatsKnown: t.StatsKnown` -> "a MEASURED empty repository
reported stats_known=<nil>". Tests assert the JSON the hub sees, not the Go
struct: measured-empty and never-measured must differ ON THE WIRE, which is the
entire point of the field.

Green gate clean: 28 packages, rc 0.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01LB8FmJaGd2cyjvy6dbEjpM

controller/internal/report/dead_backup_fields_test.go

@@ -0,0 +1,32 @@
+package report
+
+import (
+	"testing"
+
+	"gitea.dooplex.hu/admin/felhom-controller/internal/config"
+)
+
+// R-331 — the four dead BackupReport fields must STAY dead, and stay zero.
+//
+// They are declared and on the wire but nothing assigns them (disk-tier restic moved to the host
+// agent in slice 8C). The hub rendered them anyway and told every operator that every customer had
+// `Snapshots 0 · Repo Size 0 MB · Integrity Unknown` — over a box that really held 67 snapshots.
+//
+// This test exists because the failure mode is a FUTURE one: someone assigns one of these fields,
+// believes the hub will show it, and it will not — the hub reads `offsite` now. If a real producer is
+// ever wanted here, this test failing is the prompt to update the hub card in the SAME change rather
+// than shipping a field nothing renders. That is the "seam built but never wired" class, which this
+// project has hit five times.
+func TestBackupReport_DeadFieldsStayZero(t *testing.T) {
+	// A real config with a nil manager takes the early return — the shape every live report has had
+	// for these fields since 8C.
+	br := buildBackupReport(&config.Config{}, nil)
+
+	if br.SnapshotCount != 0 || br.RepoSizeMB != 0 || br.IntegrityOK || br.LastIntegrityCheck != nil {
+		t.Fatalf("a producer appeared for a dead BackupReport field "+
+			"(snapshots=%d repo_mb=%d integrity_ok=%v last_check=%v). The hub's Backup card reads the "+
+			"`offsite` object, NOT these — update hub/internal/web/backup_card.go in this same change, "+
+			"or the value will never reach a screen.",
+			br.SnapshotCount, br.RepoSizeMB, br.IntegrityOK, br.LastIntegrityCheck)
+	}
+}