v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

${IMPORT_PATH} = <system namespace root>/userdata/import — ONE drop-zone per box,
on the system drive, injected at BOTH compose-env builders with NO per-drive
fallback (unresolvable leaves it unset so compose fails loudly rather than
quietly building a second, dead drop-zone).

Third BindRoot (RootImport) + Import list in BackupSpec, extended through
ValidateBackupSpec/ClassifyBinds. Load-bearing: a stale `userdata: import/<app>`
entry against the moved bind would be a WHOLE-BLOCK reject, taking the app's
mandatory hdd classification with it.

Exhaustive-root audit: resolveAbs/structuralGuard/ComputeCaptureSet/
ComputeFabBuckets now take importRoot explicitly (an import bind resolved
against hddPath would name a directory on the wrong drive); unresolvable is
refused loudly into Skipped. GetImportRoot added to both provider interfaces.

Catalog-derived skeleton: UserdataSkeleton() -> UserdataSkeletonCarry() +
BuildUserdataSkeleton(), SORTED. The carry-list makes zero-removals true by
construction (`documents` is in no catalog app but on both boxes) and is the
fresh-box floor. The sort is not tidiness: the naive map-order derivation
measured 20 distinct outputs from 20 identical runs, which with fbNeedsRecreate
is a fleet-wide FileBrowser restart loop.

One authoritative compose parser: ParseComposeUserdataMounts now delegates to
ParseComposeClassifiableBinds. Import root excluded from per-app migration.

Surfaces: FileBrowser /srv/beolvasas source; app-page "Hova tegyem a fajlokat?"
with PathEscape deep links (never QueryEscape) and class-driven copy;
data_paths: annotation with the Fork-3 asymmetry; system-owned beolvasas SMB
share refused server-side at handler AND store, button omitted in template.

Caught on the way: the sharing template's row struct was function-local, so
adding {{if .System}} would have 500'd every share row. ShareRow is now
package-level and the render test uses the handler's own type.

Tests 915 -> 949, all green. MinAgent unchanged.

controller/internal/backup/offbox_3a_test.go

@@ -29,6 +29,7 @@ func (p *offbox3aProvider) GetStackComposePath(string) (string, bool) { return "
 func (p *offbox3aProvider) ListDeployedStacks() []StackSummary        { return nil }
 func (p *offbox3aProvider) GetStackHDDMounts(string) []string         { return nil }
 func (p *offbox3aProvider) GetStackHDDPath(n string) string           { return p.hdd[n] }
+func (p *offbox3aProvider) GetImportRoot() string                     { return "" } // R-75: no import binds in this fixture
 func (p *offbox3aProvider) GetDockerVolumes(string) []string          { return nil }
 func (p *offbox3aProvider) StopStack(string) error                    { return nil }
 func (p *offbox3aProvider) StartStack(string) error                   { return nil }

controller/internal/backup/offbox_capture.go

@@ -46,7 +46,7 @@ func (m *Manager) offboxCaptureSet(stack string) (extra []string, warns []string
 		return nil, []string{fmt.Sprintf("Figyelmeztetés: a(z) %s nincs telepítve — csak a mentési egység került a távoli mentésbe.", stack)}
 	}
 	nsRoot := m.namespaceRoot(hdd)
-	cs := appbackup.ComputeCaptureSet(binds, has, appbackup.TierOffsite, nsRoot)
+	cs := appbackup.ComputeCaptureSet(binds, has, appbackup.TierOffsite, nsRoot, m.stackProvider.GetImportRoot())
 
 	var gaps []string
 	// Structurally-refused MANDATORY paths (traversal / bare drive-root / reserved backups/ zone) are

controller/internal/backup/recovery_unit_test.go

@@ -37,6 +37,7 @@ func (f *fakeRecoveryProvider) GetStackComposePath(string) (string, bool) {
 func (f *fakeRecoveryProvider) ListDeployedStacks() []StackSummary { return nil }
 func (f *fakeRecoveryProvider) GetStackHDDMounts(string) []string  { return nil }
 func (f *fakeRecoveryProvider) GetStackHDDPath(string) string      { return f.hdd }
+func (f *fakeRecoveryProvider) GetImportRoot() string              { return "" } // R-75: no import binds in this fixture
 func (f *fakeRecoveryProvider) GetDockerVolumes(string) []string   { return nil }
 func (f *fakeRecoveryProvider) StopStack(string) error {
 	f.stopped = true

controller/internal/backup/tier2_capture.go

@@ -43,7 +43,7 @@ func (m *Manager) tier2CaptureSet(stack, nsRoot string) (legs []tier2Leg, warns
 	// Classified path.
 	if m.stackProvider != nil {
 		if binds, has := m.stackProvider.GetStackClassifiedBinds(stack); has {
-			cs := appbackup.ComputeCaptureSet(binds, has, appbackup.TierSecondary, nsRoot)
+			cs := appbackup.ComputeCaptureSet(binds, has, appbackup.TierSecondary, nsRoot, m.stackProvider.GetImportRoot())
 			var gaps []string
 			for _, sk := range cs.Skipped {
 				if sk.Class == appbackup.ClassMandatory {

controller/internal/backup/tier2_restore_test.go

@@ -27,6 +27,7 @@ func (f *t2rFakeProvider) GetStackComposePath(string) (string, bool) { return ""
 func (f *t2rFakeProvider) ListDeployedStacks() []StackSummary        { return nil }
 func (f *t2rFakeProvider) GetStackHDDMounts(string) []string         { return f.mounts }
 func (f *t2rFakeProvider) GetStackHDDPath(string) string             { return f.hdd }
+func (f *t2rFakeProvider) GetImportRoot() string                     { return "" } // R-75: no import binds in this fixture
 func (f *t2rFakeProvider) GetDockerVolumes(string) []string          { return nil }
 func (f *t2rFakeProvider) StopStack(name string) error {
 	f.stopped = append(f.stopped, name)

controller/internal/backup/tier2_v2_test.go

@@ -25,6 +25,7 @@ func (p *t2v2Provider) GetStackComposePath(string) (string, bool) { return "", f
 func (p *t2v2Provider) ListDeployedStacks() []StackSummary        { return nil }
 func (p *t2v2Provider) GetStackHDDMounts(n string) []string       { return p.mounts[n] }
 func (p *t2v2Provider) GetStackHDDPath(string) string             { return p.hdd }
+func (p *t2v2Provider) GetImportRoot() string                     { return "" } // R-75: no import binds in this fixture
 func (p *t2v2Provider) GetDockerVolumes(string) []string          { return nil }
 func (p *t2v2Provider) StopStack(string) error                    { return nil }
 func (p *t2v2Provider) StartStack(string) error                   { return nil }

controller/internal/backup/volume_dumps_test.go

@@ -25,6 +25,7 @@ func (f *volDumpFakeProvider) GetStackComposePath(string) (string, bool) { retur
 func (f *volDumpFakeProvider) ListDeployedStacks() []StackSummary        { return f.stacks }
 func (f *volDumpFakeProvider) GetStackHDDMounts(string) []string         { return nil }
 func (f *volDumpFakeProvider) GetStackHDDPath(name string) string        { return f.hdd[name] }
+func (f *volDumpFakeProvider) GetImportRoot() string                     { return "" } // R-75: no import binds in this fixture
 func (f *volDumpFakeProvider) GetDockerVolumes(name string) []string     { return f.volumes[name] }
 func (f *volDumpFakeProvider) StopStack(name string) error {
 	f.stopped = append(f.stopped, name)