hub v0.116.0: every new customer starts WITH the off-site copy (operator ruling)

Off-site is ON by default for a new customer — shared, 100 GB soft quota prefilled,
the checkbox kept so an operator can opt a customer out. The reason is this repo's
own [FACT]: the whole-guest tiers do not carry the data drive and a Tier-1 unit has
no file leg, so with this unticked a one-drive box keeps NO copy of the household's
own files. Measured on a fresh box the same day.

The quota is prefilled because the fill warning only fires when quota_gb > 0.

Also registers controller v0.244.0's app_deploy_started / app_deploy_failed in both
allowedEventTypes and customerMessages, per the rule that the two move together.

Red-proofed: dropping the default fails the new render test.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

hub/internal/api/handler.go

@@ -2070,6 +2070,17 @@ var allowedEventTypes = map[string]bool{
 	"health_critical":             true,
 	"health_recovered":            true,
 	"app_deployed":                true,
+	// R-536 (controller v0.244.0). `app_deployed` used to fire beside the 202 that merely ACCEPTED a
+	// deploy, so an install interrupted five seconds later stood on the timeline as a completed one
+	// — measured 2026-09-16 on the drill box with mealie, which ended `not_deployed`. The accept-time
+	// fact is worth keeping, so it becomes its own type, and the failure gets one too rather than
+	// being silence. `app_deployed` now means the compose up succeeded and the durable state was
+	// written.
+	//
+	// Both are customer-tier like `app_deployed` itself (NOT in operatorOnlyEvents): a household that
+	// pressed „Telepítés" is the party who wants to know it did not finish.
+	"app_deploy_started": true,
+	"app_deploy_failed":  true,
 	"app_removed":                 true,
 	"app_start_failed":            true, // controller fix-3 (CAMPAIGN-3): a deployed app is not running
 	"disaster_recovery_started":   true,