R-75: ingest binds move to ${IMPORT_PATH}; data_paths annotation

paperless-ngx and calibre-web are the only two catalog apps with a drop-zone,
and each has exactly ONE ingest bind. Both move from ${USERDATA_PATH}/import/<app>
to ${IMPORT_PATH}/<app> — the canonical root on the system drive — so a
multi-drive box has one drop-zone instead of one real folder plus a dead
lookalike on every other drive (and import/* is class: excluded, so files
stranded in a dead one would never be backed up either).

The matching backup: entries move to the new `import:` list IN THE SAME COMMIT.
This is not cosmetic: ValidateBackupSpec rejects an entry matching no compose
bind, and the rejection is WHOLE-BLOCK, so a stale `userdata: import/paperless`
would have discarded paperless's `hdd: appdata/paperless/media class: mandatory`
too and silently degraded the customer's document originals to legacy handling.
Both classes stay `excluded` — the move must not change data handling.

New data_paths: blocks on paperless-ngx, calibre-web and romm — role + Hungarian
label over paths that already exist as compose binds. Covers all three roles and
the multi-entry case. Requires controller v0.172.0 (deployed to both demo boxes
before this push, since ${IMPORT_PATH} is unset on older controllers).

Storage-layout header comments updated in both composes — they are the only
in-repo documentation of the layout.

templates/paperless-ngx/.felhom.yml

@@ -39,10 +39,19 @@ backup:
       class: mandatory        # document originals+archive — DB hashes/paths reference them
     - path: appdata/paperless/export
       class: excluded          # transient export target
-  userdata:
-    - path: import/paperless
+  import:
+    - path: paperless
       class: excluded          # consume inbox — deleted after ingest by contract
 
+# --- Customer-facing folder annotation (R-75) ---
+# ANNOTATES paths that already exist as compose binds above; never declares a new one.
+# role: import | library | export  (unknown role → that entry is simply not shown)
+data_paths:
+  - path: paperless
+    root: import
+    role: import
+    label: "Beolvasandó dokumentumok"
+
 # --- Deploy fields ---
 # Shown to the user during first deployment.
 # After deployment, values are saved to app.yaml in the stack directory.