R-75: ingest binds move to ${IMPORT_PATH}; data_paths annotation

paperless-ngx and calibre-web are the only two catalog apps with a drop-zone,
and each has exactly ONE ingest bind. Both move from ${USERDATA_PATH}/import/<app>
to ${IMPORT_PATH}/<app> — the canonical root on the system drive — so a
multi-drive box has one drop-zone instead of one real folder plus a dead
lookalike on every other drive (and import/* is class: excluded, so files
stranded in a dead one would never be backed up either).

The matching backup: entries move to the new `import:` list IN THE SAME COMMIT.
This is not cosmetic: ValidateBackupSpec rejects an entry matching no compose
bind, and the rejection is WHOLE-BLOCK, so a stale `userdata: import/paperless`
would have discarded paperless's `hdd: appdata/paperless/media class: mandatory`
too and silently degraded the customer's document originals to legacy handling.
Both classes stay `excluded` — the move must not change data handling.

New data_paths: blocks on paperless-ngx, calibre-web and romm — role + Hungarian
label over paths that already exist as compose binds. Covers all three roles and
the multi-entry case. Requires controller v0.172.0 (deployed to both demo boxes
before this push, since ${IMPORT_PATH} is unset on older controllers).

Storage-layout header comments updated in both composes — they are the only
in-repo documentation of the layout.

templates/calibre-web/.felhom.yml

@@ -21,9 +21,21 @@ backup:
   userdata:
     - path: media/books
       class: mandatory        # metadata.db lives INSIDE the tree — DB and books are one unit
-    - path: import/calibre
+  import:
+    - path: calibre
       class: excluded          # ingest inbox, transient
 
+# --- Customer-facing folder annotation (R-75) ---
+data_paths:
+  - path: calibre
+    root: import
+    role: import
+    label: "Beolvasandó e-könyvek"
+  - path: media/books
+    root: userdata
+    role: library
+    label: "E-könyvtár"
+
 # --- Deploy fields (first deployment only) ---
 deploy_fields:
   - env_var: DOMAIN

templates/calibre-web/docker-compose.yml

@@ -6,11 +6,13 @@
 # Environment variables:
 #   DOMAIN          - Your domain (e.g., demo-felhom.eu)
 #   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata)
+#   IMPORT_PATH     - KANONIKUS beolvasási gyökér a rendszerlemezen (R-75) — NEM az app lemezén
 #
 # Storage layout (felhom userdata convention):
 #   App config/DB    → calibre_web_config              (named volume, NVMe)
 #   Calibre library  → ${USERDATA_PATH}/media/books     (browsable, írható)
-#   Book ingest      → ${USERDATA_PATH}/import/calibre  (drop-zone — processed and removed)
+#   Book ingest      → ${IMPORT_PATH}/calibre           (drop-zone — processed and removed)
+#     ^ CANONICAL: one import root for the whole box, on the SYSTEM drive — NOT per data drive.
 # Run-identity: PUID/PGID 1000 (shared content group); UMASK=002 so output is group-writable.
 #
 # First-time setup:
@@ -28,7 +30,7 @@ services:
       - UMASK=002
     volumes:
       - calibre_web_config:/config
-      - ${USERDATA_PATH}/import/calibre:/cwa-book-ingest
+      - ${IMPORT_PATH}/calibre:/cwa-book-ingest
       - ${USERDATA_PATH}/media/books:/calibre-library
     networks:
       - traefik-public