hub v0.116.0: every new customer starts WITH the off-site copy (operator ruling)

Off-site is ON by default for a new customer — shared, 100 GB soft quota prefilled,
the checkbox kept so an operator can opt a customer out. The reason is this repo's
own [FACT]: the whole-guest tiers do not carry the data drive and a Tier-1 unit has
no file leg, so with this unticked a one-drive box keeps NO copy of the household's
own files. Measured on a fresh box the same day.

The quota is prefilled because the fill warning only fires when quota_gb > 0.

Also registers controller v0.244.0's app_deploy_started / app_deploy_failed in both
allowedEventTypes and customerMessages, per the rule that the two move together.

Red-proofed: dropping the default fails the new render test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CONTEXT.md

@@ -14,6 +14,27 @@
 > language, one screen, no identifiers in the prose. Same subjects, different readers; merging them
 > would make one of the two audiences stop reading. `STATUS.md` is also a **view of `OPEN-ITEMS.md`**
 > and holds nothing of its own; this file does hold its own content, namely the standing rulings below.
+## Decisions 2026-09-16 (afternoon) — the backup promise: files protected from day one
+
+**Ruling: the off-site copy is ON for every customer from day one** — shared (a sub-account on the
+pool box), **100 GB soft quota** prefilled, the checkbox kept so an operator can opt a customer out.
+Hub **v0.116.0**, `handleConfigNewForm`. The quota is prefilled because `monitor/offsite.go` only
+warns on a filling store when `quota_gb > 0`. Recorded in `07-backup-architecture.md` §6.
+
+**Ruling: the ep0 endpoint token gets `Datastore.Modify`**, narrowly — the hub's tenantsync auth-id
+only, on `/datastore/felhom-offsite` only — so the R-511 adopt path stops being inert (R-534).
+
+**Ruling: the supervisor gets a second, SLOWER counter** — N restarts in 24 h raise a warning — because
+the 3-in-15-minutes brake catches a fast crash loop and is blind to a slow one (measured: four
+restarts 20 minutes apart, none accumulating, the only trace an `info` event that mails nobody,
+R-531). **Not built in this task** — it is a row for the nightly.
+
+**What shipped with them (controller v0.244.0):** the app-backup page's contents label is now
+**per tier** and a Tier-1 unit no longer claims „Adatok" for files it cannot hold (R-537); a unit
+restore **refuses** rather than replaying a database over files that were never captured, and points
+at the route that can return them (R-538); `app_deployed` moved from the deploy's ACCEPTANCE to its
+completion, with `app_deploy_started` and `app_deploy_failed` as the honest pair (R-536).
+
 ## Decision 2026-09-16 — CC may sign `agent_update` jobs until the first paying customer (operator ruling 1)
 
 The operational signing key (`felhom-op-1`) and the recovery key stay on DooPlex at