hub v0.116.0: every new customer starts WITH the off-site copy (operator ruling)

Off-site is ON by default for a new customer — shared, 100 GB soft quota prefilled,
the checkbox kept so an operator can opt a customer out. The reason is this repo's
own [FACT]: the whole-guest tiers do not carry the data drive and a Tier-1 unit has
no file leg, so with this unticked a one-drive box keeps NO copy of the household's
own files. Measured on a fresh box the same day.

The quota is prefilled because the fill warning only fires when quota_gb > 0.

Also registers controller v0.244.0's app_deploy_started / app_deploy_failed in both
allowedEventTypes and customerMessages, per the rule that the two move together.

Red-proofed: dropping the default fails the new render test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

documentation/runbooks/VOLUNTEER-first-hour.md

@@ -22,6 +22,7 @@
 >    operator creates the tunnel (day-0 A.1) before sending this document. R-494 is narrowed to P3.
 >
 > Operator prerequisites this document silently depends on (§ „Az üzemeltető előtte"):
+> - **a távoli másolat alapból be van kapcsolva** a new customer (shared, 100 GB) — leave it on unless the customer opts out; without it the household's own files are in no backup on a one-drive box.
 > create the customer; **hand over the Tulajdonosi jelmondat out of band**; **create the Cloudflare
 > tunnel and paste its token** (day-0 runbook A.1) — until R-494 is ruled.
 

documentation/runbooks/day0-install.md

@@ -66,6 +66,13 @@ connected).*
 
 ### A.2 Create the customer in the hub
 
+> **The off-site copy is ON by default (operator ruling 2026-09-16, hub v0.116.0).** The new-customer
+> form arrives with „Enable offsite" ticked, type **shared**, soft quota **100 GB**. Leave it unless
+> the customer is deliberately opting out: with it off, a one-drive box keeps NO copy of the
+> household's own files — the whole-guest tiers do not carry the data drive and the local app backup
+> holds no file leg (`architecture/07-backup-architecture.md` §6).
+
+
 Hub UI (`https://hub.felhom.eu`, operator password) → **Customers → New**:
 
 | Field | Value | Notes |