feat(svos-front,backups): SVOS hosting bounds and previous-release assets; backup check flags fs-freeze failures and covers nh3-pve-2

Front door: request bodies capped at 1 MiB, headers within 5 s, body within 15 s, no response deadlines (SSE stays open). Validated live: 413 over the cap, stalled body cut at 15 s, signed ping and an SSE stream unaffected. svos-front-inventory also serves the previous release's hashed assets credential-free from that release's static dir, hash-checked. Backup check: reads the logs of vzdump tasks PVE records as OK and reports ERROR lines; an fs-freeze/thaw error is an application-consistency failure, new verdict DEGRADED (exit 4), wired into the alert wrapper. nh3-pve-2 added to the node and namespace lists (its job results were never read). The svos drill task is acknowledged by UPID; BACKUP_IGNORE_ACKS=1 counts it (positive control: exit 4).

configs/svos-front/Caddyfile

@@ -15,6 +15,16 @@
 	email lkraven@lkraven.com
 	auto_https disable_redirects
 	admin localhost:2019
+	# Hosting bounds (svos-dev 2026-10-05, svoperatingsystem web/README.md Hosting contract): request headers within 5 s,
+	# the whole request body within 15 s. NO write/response deadline: /api/stream (SSE) must stay open. Measured on a
+	# replica 2026-10-05 before deploy: SSE 25 s and a 20 s slow response survive on h1 and h2; a stalled body is cut at
+	# 15 s (h1 504, h2 502); unfinished headers are closed at 5 s.
+	servers {
+		timeouts {
+			read_header 5s
+			read_body 15s
+		}
+	}
 }
 
 https://svos.phasefinal.com:443 {
@@ -33,6 +43,12 @@ https://svos.phasefinal.com:443 {
 		request_header -Forwarded
 		request_header -X-SVOS-Peer
 
+		# Request bodies capped at exactly 1 MiB (1,048,576 B, = the kernel dispatcher's own cap) on every route;
+		# only /api/* and the connector read bodies at all. Over the cap -> 413. Responses are not limited.
+		request_body {
+			max_size 1MiB
+		}
+
 		# Credential-free offline shell (svos-dev 2026-10-05): the service worker fetches its hash-pinned INVENTORY
 		# with credentials:'omit', so exactly those files plus /sw.js are served BEFORE Basic auth, GET/HEAD only,
 		# exact files (no fallback). Public build bytes only; no API or connector path. The path list is GENERATED
@@ -47,6 +63,10 @@ https://svos.phasefinal.com:443 {
 			root * /opt/svos/current/static
 			file_server
 		}
+		# Previous release's hashed assets across a rollout (svos-dev 2026-10-05): open workers restore evicted inventory
+		# credential-free. Generated by the same tool: a matcher + handle rooted in THAT release's static dir, or
+		# comments only when there is no previous release.
+		import /etc/caddy/svos-public-previous
 
 		basic_auth argon2id SVOS {
 			import /etc/caddy/svos-basic-auth.accounts