R-75: ingest binds move to ${IMPORT_PATH}; data_paths annotation

paperless-ngx and calibre-web are the only two catalog apps with a drop-zone,
and each has exactly ONE ingest bind. Both move from ${USERDATA_PATH}/import/<app>
to ${IMPORT_PATH}/<app> — the canonical root on the system drive — so a
multi-drive box has one drop-zone instead of one real folder plus a dead
lookalike on every other drive (and import/* is class: excluded, so files
stranded in a dead one would never be backed up either).

The matching backup: entries move to the new `import:` list IN THE SAME COMMIT.
This is not cosmetic: ValidateBackupSpec rejects an entry matching no compose
bind, and the rejection is WHOLE-BLOCK, so a stale `userdata: import/paperless`
would have discarded paperless's `hdd: appdata/paperless/media class: mandatory`
too and silently degraded the customer's document originals to legacy handling.
Both classes stay `excluded` — the move must not change data handling.

New data_paths: blocks on paperless-ngx, calibre-web and romm — role + Hungarian
label over paths that already exist as compose binds. Covers all three roles and
the multi-entry case. Requires controller v0.172.0 (deployed to both demo boxes
before this push, since ${IMPORT_PATH} is unset on older controllers).

Storage-layout header comments updated in both composes — they are the only
in-repo documentation of the layout.

templates/paperless-ngx/.felhom.yml

@@ -39,10 +39,19 @@ backup:
       class: mandatory        # document originals+archive — DB hashes/paths reference them
     - path: appdata/paperless/export
       class: excluded          # transient export target
-  userdata:
-    - path: import/paperless
+  import:
+    - path: paperless
       class: excluded          # consume inbox — deleted after ingest by contract
 
+# --- Customer-facing folder annotation (R-75) ---
+# ANNOTATES paths that already exist as compose binds above; never declares a new one.
+# role: import | library | export  (unknown role → that entry is simply not shown)
+data_paths:
+  - path: paperless
+    root: import
+    role: import
+    label: "Beolvasandó dokumentumok"
+
 # --- Deploy fields ---
 # Shown to the user during first deployment.
 # After deployment, values are saved to app.yaml in the stack directory.

templates/paperless-ngx/docker-compose.yml

@@ -7,13 +7,17 @@
 #   DOMAIN                  - Your domain (e.g., demo-felhom.eu)
 #   HDD_PATH                - Drive namespace root (managed media/export under appdata)
 #   USERDATA_PATH           - Ügyfél-tartalom gyökér (<namespace>/userdata)
+#   IMPORT_PATH             - KANONIKUS beolvasási gyökér a rendszerlemezen (R-75) — NEM az app lemezén
 #   PAPERLESS_SECRET_KEY    - Random secret (auto-generated)
 #   DB_PASSWORD             - PostgreSQL password (auto-generated)
 #   PAPERLESS_ADMIN_USER    - Initial admin username (default: admin)
 #   PAPERLESS_ADMIN_PASSWORD - Initial admin password
 #
 # Storage layout (felhom userdata convention):
-#   Consume drop-zone → ${USERDATA_PATH}/import/paperless  (browsable — drop files here via FileBrowser)
+#   Consume drop-zone → ${IMPORT_PATH}/paperless             (browsable — drop files here via FileBrowser)
+#     ^ CANONICAL: one import root for the whole box, on the SYSTEM drive — NOT per data drive.
+#       Each drop-zone app has exactly ONE ingest bind, so a per-drive import/ would put a folder
+#       that looks like a drop-zone on every drive while only one of them does anything.
 #   Document media    → ${HDD_PATH}/appdata/paperless/media  (app-managed originals + archive)
 #   Export folder     → ${HDD_PATH}/appdata/paperless/export (app-managed backups)
 #   App data/index    → paperless_data                       (named volume, NVMe)
@@ -63,7 +67,7 @@ services:
     volumes:
       - paperless_data:/usr/src/paperless/data
       - ${HDD_PATH}/appdata/paperless/media:/usr/src/paperless/media
-      - ${USERDATA_PATH}/import/paperless:/usr/src/paperless/consume
+      - ${IMPORT_PATH}/paperless:/usr/src/paperless/consume
       - ${HDD_PATH}/appdata/paperless/export:/usr/src/paperless/export
     networks:
       - traefik-public