v0.4.6: MariaDB validation fix + dashboard deployed-only + protected stack restart

- Fix ValidateDump() to scan first 10 lines for header (MariaDB 11.4+ sandbox comment)
- Dashboard shows only deployed/protected stacks, heading "Telepített alkalmazások"
- Protected stacks show restart button when operational (both dashboard + stacks page)
- API blocks all actions except restart on protected stacks
- docker-setup.sh creates .felhom.yml for FileBrowser (subdomain: files)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

controller/internal/api/router.go

@@ -207,6 +207,12 @@ func (r *Router) deployStack(w http.ResponseWriter, req *http.Request, name stri
 func (r *Router) actionStack(w http.ResponseWriter, action, name string) {
 	r.logger.Printf("[API] %s requested for stack: %s", action, name)
 
+	// Protected stacks only allow restart — block all other actions
+	if r.cfg.IsProtectedStack(name) && action != "restart" {
+		writeJSON(w, http.StatusForbidden, apiResponse{OK: false, Error: fmt.Sprintf("cannot %s protected stack %s", action, name)})
+		return
+	}
+
 	var err error
 	switch action {
 	case "start":