v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

${IMPORT_PATH} = <system namespace root>/userdata/import — ONE drop-zone per box,
on the system drive, injected at BOTH compose-env builders with NO per-drive
fallback (unresolvable leaves it unset so compose fails loudly rather than
quietly building a second, dead drop-zone).

Third BindRoot (RootImport) + Import list in BackupSpec, extended through
ValidateBackupSpec/ClassifyBinds. Load-bearing: a stale `userdata: import/<app>`
entry against the moved bind would be a WHOLE-BLOCK reject, taking the app's
mandatory hdd classification with it.

Exhaustive-root audit: resolveAbs/structuralGuard/ComputeCaptureSet/
ComputeFabBuckets now take importRoot explicitly (an import bind resolved
against hddPath would name a directory on the wrong drive); unresolvable is
refused loudly into Skipped. GetImportRoot added to both provider interfaces.

Catalog-derived skeleton: UserdataSkeleton() -> UserdataSkeletonCarry() +
BuildUserdataSkeleton(), SORTED. The carry-list makes zero-removals true by
construction (`documents` is in no catalog app but on both boxes) and is the
fresh-box floor. The sort is not tidiness: the naive map-order derivation
measured 20 distinct outputs from 20 identical runs, which with fbNeedsRecreate
is a fleet-wide FileBrowser restart loop.

One authoritative compose parser: ParseComposeUserdataMounts now delegates to
ParseComposeClassifiableBinds. Import root excluded from per-app migration.

Surfaces: FileBrowser /srv/beolvasas source; app-page "Hova tegyem a fajlokat?"
with PathEscape deep links (never QueryEscape) and class-driven copy;
data_paths: annotation with the Fork-3 asymmetry; system-owned beolvasas SMB
share refused server-side at handler AND store, button omitted in template.

Caught on the way: the sharing template's row struct was function-local, so
adding {{if .System}} would have 500'd every share row. ShareRow is now
package-level and the render test uses the handler's own type.

Tests 915 -> 949, all green. MinAgent unchanged.

controller/internal/settings/smb.go

@@ -30,8 +30,19 @@ type SMBShare struct {
 	ReadOnly  bool   `json:"read_only,omitempty"` // smb.conf `read only = yes` + a :ro compose bind
 	Offsite   bool   `json:"offsite"`             // [R4] true (default) → backup class mandatory; false → optional (tier-2 only)
 	CreatedAt string `json:"created_at"`          // RFC3339
+	// System marks a controller-OWNED share the customer may not delete (R-75). Today that is the
+	// canonical drop-zone („beolvasas"), which is auto-created whenever sharing is enabled and whose
+	// absence would silently break the documented „drop a file in Beolvasás over the network" flow.
+	// Its Path is a controller-generated constant derived from config — never customer input — which
+	// is why it does NOT go through sharingResolvePath (that guard exists to validate the paths a
+	// CUSTOMER picks, a different trust class).
+	System bool `json:"system,omitempty"`
 }
 
+// SystemImportShareName is the fixed name of the canonical drop-zone share (R-75). ASCII and
+// nbNameRe-safe on purpose: it is a NetBIOS share name and appears in \\SERVER\<name>.
+const SystemImportShareName = "beolvasas"
+
 // nbNameRe matches a NetBIOS-safe name: 1–15 chars, letters/digits/hyphen/underscore, not starting
 // or ending with a hyphen. Deliberately stricter than SMB share-name rules (slice 1 keeps the flat
 // name and the share name in the same safe space; slice 2 may relax share names).
@@ -172,9 +183,19 @@ func (s *Settings) AddSMBShare(share SMBShare) error {
 }
 
 // RemoveSMBShare deletes a share by name (case-insensitive). Config-only: never touches the folder.
+//
+// A System share is REFUSED here, at the store layer, so every caller inherits the rule — the web
+// handler has its own check too, and that duplication is deliberate: a handler test that POSTs
+// directly proves nothing about UI reachability, and a hidden button proves nothing about
+// enforcement (the v0.70.1 lesson). They are separate concerns.
 func (s *Settings) RemoveSMBShare(name string) error {
 	s.mu.Lock()
 	defer s.mu.Unlock()
+	for _, ex := range s.SMBShares {
+		if strings.EqualFold(ex.Name, name) && ex.System {
+			return fmt.Errorf("a(z) „%s” megosztás a rendszer része, nem törölhető", ex.Name)
+		}
+	}
 	var kept []SMBShare
 	found := false
 	for _, ex := range s.SMBShares {