v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

${IMPORT_PATH} = <system namespace root>/userdata/import — ONE drop-zone per box,
on the system drive, injected at BOTH compose-env builders with NO per-drive
fallback (unresolvable leaves it unset so compose fails loudly rather than
quietly building a second, dead drop-zone).

Third BindRoot (RootImport) + Import list in BackupSpec, extended through
ValidateBackupSpec/ClassifyBinds. Load-bearing: a stale `userdata: import/<app>`
entry against the moved bind would be a WHOLE-BLOCK reject, taking the app's
mandatory hdd classification with it.

Exhaustive-root audit: resolveAbs/structuralGuard/ComputeCaptureSet/
ComputeFabBuckets now take importRoot explicitly (an import bind resolved
against hddPath would name a directory on the wrong drive); unresolvable is
refused loudly into Skipped. GetImportRoot added to both provider interfaces.

Catalog-derived skeleton: UserdataSkeleton() -> UserdataSkeletonCarry() +
BuildUserdataSkeleton(), SORTED. The carry-list makes zero-removals true by
construction (`documents` is in no catalog app but on both boxes) and is the
fresh-box floor. The sort is not tidiness: the naive map-order derivation
measured 20 distinct outputs from 20 identical runs, which with fbNeedsRecreate
is a fleet-wide FileBrowser restart loop.

One authoritative compose parser: ParseComposeUserdataMounts now delegates to
ParseComposeClassifiableBinds. Import root excluded from per-app migration.

Surfaces: FileBrowser /srv/beolvasas source; app-page "Hova tegyem a fajlokat?"
with PathEscape deep links (never QueryEscape) and class-driven copy;
data_paths: annotation with the Fork-3 asymmetry; system-owned beolvasas SMB
share refused server-side at handler AND store, button omitted in template.

Caught on the way: the sharing template's row struct was function-local, so
adding {{if .System}} would have 500'd every share row. ShareRow is now
package-level and the render test uses the handler's own type.

Tests 915 -> 949, all green. MinAgent unchanged.

controller/internal/infra/infra.go

@@ -25,6 +25,15 @@ const (
 	TraefikImage     = "traefik:v3.6.7"
 	CloudflaredImage = "cloudflare/cloudflared:2026.6.0"
 	FileBrowserImage = "gtstef/filebrowser:1.3.3-stable"
+	// FileBrowserImportMount is the in-container mount point NAME for the canonical drop-zone
+	// (R-75): the bind lands at /srv/<this>. ASCII and space-free on purpose — it appears in a
+	// container path, in the generated compose, and (percent-encoded) in the deep-link URL.
+	FileBrowserImportMount = "beolvasas"
+	// FileBrowserImportLabel is the Hungarian SIDEBAR name of that source. It is the display name and
+	// it IS the URL identity: FileBrowser Quantum keys sources by name (SPIKE P1) and the deep-link
+	// template is /files/{encodeURIComponent(name)}/... (SPIKE P2). Accents round-trip correctly —
+	// the spike verified an accented, spaced and ampersand'd source name end to end.
+	FileBrowserImportLabel = "Beolvasás"
 	// SambaImage is our own pinned LAN-sharing image (R-7 slice 1). Built by
 	// controller/scripts/build-samba-image.sh from controller/infra-images/samba/. NEVER :latest.
 	SambaImage = "gitea.dooplex.hu/admin/felhom-samba:1.1.0"
@@ -256,12 +265,20 @@ http:
 // RenderFileBrowserConfig returns a FileBrowser Quantum config.yaml with one source per registered
 // storage path (each a named sidebar entry). Empty paths → a single default /srv source. Ported
 // verbatim from internal/web/handlers.go.
-func RenderFileBrowserConfig(paths []settings.StoragePath) string {
+func RenderFileBrowserConfig(paths []settings.StoragePath, importSource bool) string {
 	var sources string
-	if len(paths) == 0 {
+	// The canonical drop-zone (R-75) is FIRST and is NOT a registered storage path — it is a separate
+	// bind of <system namespace>/userdata/import. Separate rather than nested inside a drive source:
+	// the spike proved a nested source works but gets indexed TWICE (once as its own root, once as a
+	// child of the parent drive), which buys nothing over a separate bind.
+	if importSource {
+		sources += fmt.Sprintf("    - path: %q\n      name: %q\n      config:\n        defaultEnabled: true\n",
+			"/srv/"+FileBrowserImportMount, FileBrowserImportLabel)
+	}
+	if len(paths) == 0 && !importSource {
 		sources = `    - path: "/srv"
 `
-	} else {
+	} else if len(paths) > 0 {
 		for _, sp := range paths {
 			mountName := filepath.Base(sp.Path)
 			label := sp.Label

controller/internal/infra/infra_test.go

@@ -46,7 +46,7 @@ func allRendered(t *testing.T) []string {
 	}
 	out = append(out, RenderFileBrowserCompose("example.com", nil))
 	out = append(out, RenderFileBrowserCompose("example.com", []string{"      - /mnt/hdd_1:/srv/hdd_1"}))
-	out = append(out, RenderFileBrowserConfig(nil))
+	out = append(out, RenderFileBrowserConfig(nil, false))
 	out = append(out, RenderServersTransports())
 	return out
 }
@@ -224,13 +224,13 @@ func TestFileBrowserRender(t *testing.T) {
 	}
 
 	// Default config (no storage paths) → a single /srv source.
-	def := RenderFileBrowserConfig(nil)
+	def := RenderFileBrowserConfig(nil, false)
 	if !strings.Contains(def, `- path: "/srv"`) {
 		t.Errorf("empty config must default to a /srv source: %q", def)
 	}
 
 	// With paths → a named per-drive source.
-	withPaths := RenderFileBrowserConfig([]settings.StoragePath{{Path: "/mnt/hdd_1", Label: "Media"}})
+	withPaths := RenderFileBrowserConfig([]settings.StoragePath{{Path: "/mnt/hdd_1", Label: "Media"}}, false)
 	if !strings.Contains(withPaths, `- path: "/srv/hdd_1"`) || !strings.Contains(withPaths, `name: "Media"`) {
 		t.Errorf("storage path not wired into filebrowser config: %q", withPaths)
 	}