userdata layout: repoint customer-content mounts to ${USERDATA_PATH}

Move every shared-media + ingest mount off ${HDD_PATH}/media onto the new
${USERDATA_PATH}/... convention (controller injects USERDATA_PATH = <namespace>/userdata):
- jellyfin/emby/plex: media:/media:ro ; navidrome: media/music:ro
- audiobookshelf (user 1000:1000): media/{audiobooks,podcasts}
- komga (user 1000:1000): media/comics
- calibre-web (UMASK=002): library->media/books, ingest->import/calibre
- radarr/sonarr (UMASK=002): media/{movies,tv} + downloads (sibling, same FS)
- romm: ROM library -> userdata/roms (browsable); resources stay in appdata
- immich: + external library media/photos:/external/photos:ro (registration is a
  post-deploy admin step — flagged in compose + .felhom.yml)
- paperless: consume -> import/paperless (USERMAP 1000)
- nextcloud: unchanged (fully app-managed)
.felhom.yml first_steps updated for the new browsable drop-zones.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

templates/audiobookshelf/docker-compose.yml

@@ -5,20 +5,28 @@
 #
 # Environment variables:
 #   DOMAIN          - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH        - Hangoskönyv tár útvonal
+#   USERDATA_PATH   - Ügyfél-tartalom gyökér (<namespace>/userdata)
+#
+# Storage layout (felhom userdata convention):
+#   Hangoskönyvek → ${USERDATA_PATH}/media/audiobooks   (írható)
+#   Podcastok     → ${USERDATA_PATH}/media/podcasts      (írható)
+# Run-identity: user 1000:1000 so files land group-writable for the shared content group
+# (GID 1000); the userdata dirs are setgid 2775. If the image fails to start healthy as
+# 1000, the controller/operator reverts to root and relies on setgid (see REPORT).
 
 services:
   audiobookshelf:
     image: ghcr.io/advplyr/audiobookshelf:2.19.5
     container_name: audiobookshelf
     restart: unless-stopped
+    user: "1000:1000"
     environment:
       - TZ=Europe/Budapest
     volumes:
       - audiobookshelf_config:/config
       - audiobookshelf_metadata:/metadata
-      - ${HDD_PATH}/media/audiobooks:/audiobooks
-      - ${HDD_PATH}/media/podcasts:/podcasts
+      - ${USERDATA_PATH}/media/audiobooks:/audiobooks
+      - ${USERDATA_PATH}/media/podcasts:/podcasts
     networks:
       - traefik-public
     deploy: