fix: scope FileBrowser DB reset to restore-only path

Normal storage add/remove no longer nukes the FileBrowser database volume.
A .fb-reset flag file is written during restore and consumed on next startup.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/web/handlers.go

@@ -1566,6 +1566,17 @@ func (s *Server) settingsStorageLabelHandler(w http.ResponseWriter, r *http.Requ
 // SyncFileBrowserMounts regenerates FileBrowser's docker-compose.yml and config.yaml
 // with volume mounts and sources for all registered storage paths, then recreates the container.
 func (s *Server) SyncFileBrowserMounts() {
+	s.syncFileBrowserMounts(false)
+}
+
+// SyncFileBrowserMountsReset is like SyncFileBrowserMounts but resets the FileBrowser
+// database when sources change. Use only after restore — normal operations should use
+// SyncFileBrowserMounts to preserve user accounts, permissions, and share links.
+func (s *Server) SyncFileBrowserMountsReset() {
+	s.syncFileBrowserMounts(true)
+}
+
+func (s *Server) syncFileBrowserMounts(resetDBOnChange bool) {
 	// Prevent concurrent syncs — multiple callers can race on the same files (H5 fix).
 	s.fileBrowserMu.Lock()
 	defer s.fileBrowserMu.Unlock()
@@ -1625,13 +1636,13 @@ func (s *Server) SyncFileBrowserMounts() {
 		return
 	}
 
-	// If sources changed, reset database so FileBrowser re-reads config.yaml.
-	// The database caches user source preferences from the old config.
-	if sourcesChanged {
-		s.logger.Printf("[INFO] FileBrowser sources changed — resetting database")
+	// If sources changed and caller requested a DB reset (restore flow),
+	// nuke the data volume so FileBrowser re-reads config.yaml from scratch.
+	// Normal operations skip this to preserve user accounts, permissions, and share links.
+	if sourcesChanged && resetDBOnChange {
+		s.logger.Printf("[INFO] FileBrowser sources changed — resetting database (restore mode)")
 		resetCtx, resetCancel := context.WithTimeout(context.Background(), 30*time.Second)
 		defer resetCancel()
-		// Stop container first, then remove the data volume
 		stop := exec.CommandContext(resetCtx, "docker", "compose", "down", "-v")
 		stop.Dir = stackDir
 		if out, err := stop.CombinedOutput(); err != nil {

controller/internal/web/server.go

@@ -114,8 +114,16 @@ func NewServer(cfg *config.Config, stackMgr *stacks.Manager, cpuCollector *syste
 		logger.Printf("[INFO] Auth: no password configured — dashboard is open")
 	}
 
-	// Sync FileBrowser config on startup to ensure mounts and sources are current
-	go s.SyncFileBrowserMounts()
+	// Sync FileBrowser config on startup to ensure mounts and sources are current.
+	// After a restore, a flag file signals that the database should be reset
+	// (stale source prefs from initial install). Consume the flag and reset.
+	fbResetFlag := filepath.Join(cfg.Paths.DataDir, ".fb-reset")
+	if _, err := os.Stat(fbResetFlag); err == nil {
+		os.Remove(fbResetFlag)
+		go s.SyncFileBrowserMountsReset()
+	} else {
+		go s.SyncFileBrowserMounts()
+	}
 
 	return s
 }