v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

${IMPORT_PATH} = <system namespace root>/userdata/import — ONE drop-zone per box,
on the system drive, injected at BOTH compose-env builders with NO per-drive
fallback (unresolvable leaves it unset so compose fails loudly rather than
quietly building a second, dead drop-zone).

Third BindRoot (RootImport) + Import list in BackupSpec, extended through
ValidateBackupSpec/ClassifyBinds. Load-bearing: a stale `userdata: import/<app>`
entry against the moved bind would be a WHOLE-BLOCK reject, taking the app's
mandatory hdd classification with it.

Exhaustive-root audit: resolveAbs/structuralGuard/ComputeCaptureSet/
ComputeFabBuckets now take importRoot explicitly (an import bind resolved
against hddPath would name a directory on the wrong drive); unresolvable is
refused loudly into Skipped. GetImportRoot added to both provider interfaces.

Catalog-derived skeleton: UserdataSkeleton() -> UserdataSkeletonCarry() +
BuildUserdataSkeleton(), SORTED. The carry-list makes zero-removals true by
construction (`documents` is in no catalog app but on both boxes) and is the
fresh-box floor. The sort is not tidiness: the naive map-order derivation
measured 20 distinct outputs from 20 identical runs, which with fbNeedsRecreate
is a fleet-wide FileBrowser restart loop.

One authoritative compose parser: ParseComposeUserdataMounts now delegates to
ParseComposeClassifiableBinds. Import root excluded from per-app migration.

Surfaces: FileBrowser /srv/beolvasas source; app-page "Hova tegyem a fajlokat?"
with PathEscape deep links (never QueryEscape) and class-driven copy;
data_paths: annotation with the Fork-3 asymmetry; system-owned beolvasas SMB
share refused server-side at handler AND store, button omitted in template.

Caught on the way: the sharing template's row struct was function-local, so
adding {{if .System}} would have 500'd every share row. ShareRow is now
package-level and the render test uses the handler's own type.

Tests 915 -> 949, all green. MinAgent unchanged.

controller/internal/appbackup/captureset_test.go

@@ -38,12 +38,12 @@ func TestComputeCaptureSet_PerTierSplit(t *testing.T) {
 		{ComposeBind: ComposeBind{Root: RootUserdata, RelPath: "media/photos", ReadOnly: true}, Class: ClassOptional, Origin: OriginExplicit},
 	}
 
-	off := ComputeCaptureSet(binds, true, TierOffsite, drv)
+	off := ComputeCaptureSet(binds, true, TierOffsite, drv, "")
 	if got, want := absList(off), []string{hdd("appdata/immich")}; !reflect.DeepEqual(got, want) {
 		t.Errorf("offsite Paths = %v, want %v (mandatory only — the :ro optional must NOT ship offsite)", got, want)
 	}
 
-	sec := ComputeCaptureSet(binds, true, TierSecondary, drv)
+	sec := ComputeCaptureSet(binds, true, TierSecondary, drv, "")
 	want := []string{hdd("appdata/immich"), udat("media/photos")}
 	if got := absList(sec); !reflect.DeepEqual(got, want) {
 		t.Errorf("secondary Paths = %v, want %v (sorted)", got, want)
@@ -72,7 +72,7 @@ func TestComputeCaptureSet_LegacyInert(t *testing.T) {
 		{ComposeBind: ComposeBind{Root: RootHDD, RelPath: "appdata/sonarr"}, Origin: OriginLegacy},
 	}
 	for _, tier := range []CaptureTier{TierOffsite, TierSecondary} {
-		cs := ComputeCaptureSet(binds, false, tier, drv)
+		cs := ComputeCaptureSet(binds, false, tier, drv, "")
 		if cs.HasClassification {
 			t.Errorf("%s: HasClassification=true for a legacy app", tier)
 		}
@@ -94,7 +94,7 @@ func TestComputeCaptureSet_ExcludedInvisible(t *testing.T) {
 		{ComposeBind: ComposeBind{Root: RootUserdata, RelPath: "import/paperless"}, Class: ClassExcluded, Origin: OriginExplicit},
 	}
 	for _, tier := range []CaptureTier{TierOffsite, TierSecondary} {
-		cs := ComputeCaptureSet(binds, true, tier, drv)
+		cs := ComputeCaptureSet(binds, true, tier, drv, "")
 		if got, want := absList(cs), []string{hdd("appdata/paperless/media")}; !reflect.DeepEqual(got, want) {
 			t.Errorf("%s Paths = %v, want %v (excluded filtered)", tier, got, want)
 		}
@@ -113,7 +113,7 @@ func TestComputeCaptureSet_StructuralGuards(t *testing.T) {
 		{ComposeBind: ComposeBind{Root: RootHDD, RelPath: "backups/primary/x"}, Class: ClassMandatory, Origin: OriginDefaultWritable}, // d3 reserved zone
 		{ComposeBind: ComposeBind{Root: RootUserdata, RelPath: ""}, Class: ClassMandatory, Origin: OriginDefaultWritable},             // d4 bare userdata — ALLOWED
 	}
-	cs := ComputeCaptureSet(binds, true, TierOffsite, drv)
+	cs := ComputeCaptureSet(binds, true, TierOffsite, drv, "")
 
 	// Paths: ONLY d4's userdata root — no escaped root, no backups/ anywhere.
 	if got, want := absList(cs), []string{udat("")}; !reflect.DeepEqual(got, want) {
@@ -156,7 +156,7 @@ func TestComputeCaptureSet_LegitDotDotName(t *testing.T) {
 	binds := []ClassifiedBind{
 		{ComposeBind: ComposeBind{Root: RootHDD, RelPath: "appdata/a..b"}, Class: ClassMandatory, Origin: OriginExplicit},
 	}
-	cs := ComputeCaptureSet(binds, true, TierOffsite, drv)
+	cs := ComputeCaptureSet(binds, true, TierOffsite, drv, "")
 	if got, want := absList(cs), []string{hdd("appdata/a..b")}; !reflect.DeepEqual(got, want) {
 		t.Errorf("Paths = %v, want %v (a..b is a legit name, not traversal)", got, want)
 	}
@@ -174,7 +174,7 @@ func TestComputeCaptureSet_ContainmentAndCollision(t *testing.T) {
 		{ComposeBind: ComposeBind{Root: RootHDD, RelPath: "userdata/media"}, Class: ClassOptional, Origin: OriginExplicit},           // Abs collides with next
 		{ComposeBind: ComposeBind{Root: RootUserdata, RelPath: "media"}, Class: ClassMandatory, Origin: OriginExplicit},              // same Abs, mandatory
 	}
-	cs := ComputeCaptureSet(binds, true, TierSecondary, drv)
+	cs := ComputeCaptureSet(binds, true, TierSecondary, drv, "")
 
 	want := []string{hdd("appdata/paperless"), udat("media")}
 	if got := absList(cs); !reflect.DeepEqual(got, want) {
@@ -186,7 +186,7 @@ func TestComputeCaptureSet_ContainmentAndCollision(t *testing.T) {
 	}
 
 	// determinism: recompute and compare full struct
-	cs2 := ComputeCaptureSet(binds, true, TierSecondary, drv)
+	cs2 := ComputeCaptureSet(binds, true, TierSecondary, drv, "")
 	if !reflect.DeepEqual(cs, cs2) {
 		t.Error("ComputeCaptureSet is non-deterministic across runs")
 	}