v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

${IMPORT_PATH} = <system namespace root>/userdata/import — ONE drop-zone per box,
on the system drive, injected at BOTH compose-env builders with NO per-drive
fallback (unresolvable leaves it unset so compose fails loudly rather than
quietly building a second, dead drop-zone).

Third BindRoot (RootImport) + Import list in BackupSpec, extended through
ValidateBackupSpec/ClassifyBinds. Load-bearing: a stale `userdata: import/<app>`
entry against the moved bind would be a WHOLE-BLOCK reject, taking the app's
mandatory hdd classification with it.

Exhaustive-root audit: resolveAbs/structuralGuard/ComputeCaptureSet/
ComputeFabBuckets now take importRoot explicitly (an import bind resolved
against hddPath would name a directory on the wrong drive); unresolvable is
refused loudly into Skipped. GetImportRoot added to both provider interfaces.

Catalog-derived skeleton: UserdataSkeleton() -> UserdataSkeletonCarry() +
BuildUserdataSkeleton(), SORTED. The carry-list makes zero-removals true by
construction (`documents` is in no catalog app but on both boxes) and is the
fresh-box floor. The sort is not tidiness: the naive map-order derivation
measured 20 distinct outputs from 20 identical runs, which with fbNeedsRecreate
is a fleet-wide FileBrowser restart loop.

One authoritative compose parser: ParseComposeUserdataMounts now delegates to
ParseComposeClassifiableBinds. Import root excluded from per-app migration.

Surfaces: FileBrowser /srv/beolvasas source; app-page "Hova tegyem a fajlokat?"
with PathEscape deep links (never QueryEscape) and class-driven copy;
data_paths: annotation with the Fork-3 asymmetry; system-owned beolvasas SMB
share refused server-side at handler AND store, button omitted in template.

Caught on the way: the sharing template's row struct was function-local, so
adding {{if .System}} would have 500'd every share row. ShareRow is now
package-level and the render test uses the handler's own type.

Tests 915 -> 949, all green. MinAgent unchanged.

controller/internal/stacks/deploy.go

@@ -558,18 +558,29 @@ func (m *Manager) composeExecWithEnv(dir string, env map[string]string, args ...
 		cmdEnv = append(cmdEnv, fmt.Sprintf("%s=%s", k, v))
 	}
 	cmdEnv = append(cmdEnv, fmt.Sprintf("DOMAIN=%s", m.cfg.Customer.Domain))
-	cmdEnv = withUserdataPath(cmdEnv, env["HDD_PATH"])
+	cmdEnv = withPathVars(cmdEnv, env["HDD_PATH"], m.GetImportRoot())
 	return m.composeExecCustomEnv(dir, cmdEnv, args...)
 }
 
-// withUserdataPath appends USERDATA_PATH=<hdd>/userdata to a "K=V" env slice when hdd is non-empty.
+// withPathVars appends the two derived path variables to a "K=V" env slice:
+//
+//	USERDATA_PATH=<hdd>/userdata   — per-app, on the app's OWN drive (when hdd is non-empty)
+//	IMPORT_PATH=<importRoot>       — CANONICAL, on the system drive (when importRoot is non-empty)
+//
 // Shared by BOTH compose-env builders (stackEnv for start/redeploy, composeExecWithEnv for the initial
-// deploy) so ${USERDATA_PATH} always resolves — the initial-deploy path missing it bound a bogus
-// root-owned dir at the container root.
-func withUserdataPath(cmdEnv []string, hdd string) []string {
+// deploy) so the variables always resolve — the initial-deploy path missing USERDATA_PATH bound a
+// bogus root-owned dir at the container root, and IMPORT_PATH has the identical failure mode.
+//
+// An unresolvable importRoot is left UNSET on purpose (the caller logs it): compose then fails loudly
+// on an unresolved ${IMPORT_PATH} rather than silently falling back to a per-drive path, which would
+// recreate the dead-drop-zone shape R-75 exists to remove.
+func withPathVars(cmdEnv []string, hdd, importRoot string) []string {
 	if hdd != "" {
 		cmdEnv = append(cmdEnv, "USERDATA_PATH="+appbackup.UserdataDir(hdd))
 	}
+	if importRoot != "" {
+		cmdEnv = append(cmdEnv, "IMPORT_PATH="+importRoot)
+	}
 	return cmdEnv
 }