userdata layout: repoint customer-content mounts to ${USERDATA_PATH}

Move every shared-media + ingest mount off ${HDD_PATH}/media onto the new
${USERDATA_PATH}/... convention (controller injects USERDATA_PATH = <namespace>/userdata):
- jellyfin/emby/plex: media:/media:ro ; navidrome: media/music:ro
- audiobookshelf (user 1000:1000): media/{audiobooks,podcasts}
- komga (user 1000:1000): media/comics
- calibre-web (UMASK=002): library->media/books, ingest->import/calibre
- radarr/sonarr (UMASK=002): media/{movies,tv} + downloads (sibling, same FS)
- romm: ROM library -> userdata/roms (browsable); resources stay in appdata
- immich: + external library media/photos:/external/photos:ro (registration is a
  post-deploy admin step — flagged in compose + .felhom.yml)
- paperless: consume -> import/paperless (USERMAP 1000)
- nextcloud: unchanged (fully app-managed)
.felhom.yml first_steps updated for the new browsable drop-zones.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

templates/paperless-ngx/.felhom.yml

@@ -131,7 +131,7 @@ app_info:
     - 'Nyisd meg a paperless.DOMAIN címet a böngészőben'
     - 'Jelentkezz be: admin / admin'
     - 'Változtasd meg azonnal a jelszót'
-    - 'Tölts fel egy dokumentumot (PDF, kép) és várd meg az OCR feldolgozást'
+    - 'Tölts fel egy dokumentumot a webfelületen, VAGY dobd a Fájlkezelőben (FileBrowser) az import/paperless mappába — onnan automatikusan beolvassa és OCR-rel feldolgozza'
     - 'Hozz létre címkéket és levelezőket az automatikus rendszerezéshez'
 
   prerequisites:

templates/paperless-ngx/docker-compose.yml

@@ -5,17 +5,20 @@
 #
 # Environment variables:
 #   DOMAIN                  - Your domain (e.g., demo-felhom.eu)
-#   HDD_PATH                - HDD mount path (e.g., /mnt/hdd_1)
+#   HDD_PATH                - Drive namespace root (managed media/export under appdata)
+#   USERDATA_PATH           - Ügyfél-tartalom gyökér (<namespace>/userdata)
 #   PAPERLESS_SECRET_KEY    - Random secret (auto-generated)
 #   DB_PASSWORD             - PostgreSQL password (auto-generated)
 #   PAPERLESS_ADMIN_USER    - Initial admin username (default: admin)
 #   PAPERLESS_ADMIN_PASSWORD - Initial admin password
 #
-# Storage layout:
-#   Consume folder   → ${HDD_PATH}/appdata/paperless/consume   (HDD, drop files here)
-#   Document media   → ${HDD_PATH}/appdata/paperless/media      (HDD, originals + archive)
-#   Export folder    → ${HDD_PATH}/appdata/paperless/export     (HDD, for backups)
-#   App data/index   → paperless_data                            (named volume, NVMe)
+# Storage layout (felhom userdata convention):
+#   Consume drop-zone → ${USERDATA_PATH}/import/paperless  (browsable — drop files here via FileBrowser)
+#   Document media    → ${HDD_PATH}/appdata/paperless/media  (app-managed originals + archive)
+#   Export folder     → ${HDD_PATH}/appdata/paperless/export (app-managed backups)
+#   App data/index    → paperless_data                       (named volume, NVMe)
+# Run-identity: USERMAP_UID/GID 1000 → paperless consumes + DELETES from the import drop-zone
+# (group 1000, setgid 2775) without permission errors.
 #   PostgreSQL data  → paperless_postgres_data                   (named volume, NVMe)
 #   Redis data       → paperless_redis_data                      (named volume, NVMe)
 #
@@ -55,7 +58,7 @@ services:
     volumes:
       - paperless_data:/usr/src/paperless/data
       - ${HDD_PATH}/appdata/paperless/media:/usr/src/paperless/media
-      - ${HDD_PATH}/appdata/paperless/consume:/usr/src/paperless/consume
+      - ${USERDATA_PATH}/import/paperless:/usr/src/paperless/consume
       - ${HDD_PATH}/appdata/paperless/export:/usr/src/paperless/export
     networks:
       - traefik-public