v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

${IMPORT_PATH} = <system namespace root>/userdata/import — ONE drop-zone per box,
on the system drive, injected at BOTH compose-env builders with NO per-drive
fallback (unresolvable leaves it unset so compose fails loudly rather than
quietly building a second, dead drop-zone).

Third BindRoot (RootImport) + Import list in BackupSpec, extended through
ValidateBackupSpec/ClassifyBinds. Load-bearing: a stale `userdata: import/<app>`
entry against the moved bind would be a WHOLE-BLOCK reject, taking the app's
mandatory hdd classification with it.

Exhaustive-root audit: resolveAbs/structuralGuard/ComputeCaptureSet/
ComputeFabBuckets now take importRoot explicitly (an import bind resolved
against hddPath would name a directory on the wrong drive); unresolvable is
refused loudly into Skipped. GetImportRoot added to both provider interfaces.

Catalog-derived skeleton: UserdataSkeleton() -> UserdataSkeletonCarry() +
BuildUserdataSkeleton(), SORTED. The carry-list makes zero-removals true by
construction (`documents` is in no catalog app but on both boxes) and is the
fresh-box floor. The sort is not tidiness: the naive map-order derivation
measured 20 distinct outputs from 20 identical runs, which with fbNeedsRecreate
is a fleet-wide FileBrowser restart loop.

One authoritative compose parser: ParseComposeUserdataMounts now delegates to
ParseComposeClassifiableBinds. Import root excluded from per-app migration.

Surfaces: FileBrowser /srv/beolvasas source; app-page "Hova tegyem a fajlokat?"
with PathEscape deep links (never QueryEscape) and class-driven copy;
data_paths: annotation with the Fork-3 asymmetry; system-owned beolvasas SMB
share refused server-side at handler AND store, button omitted in template.

Caught on the way: the sharing template's row struct was function-local, so
adding {{if .System}} would have 500'd every share row. ShareRow is now
package-level and the render test uses the handler's own type.

Tests 915 -> 949, all green. MinAgent unchanged.

controller/internal/stacks/migrate.go

@@ -652,7 +652,8 @@ func (m *Manager) migCleanupAllowed(j *MigrationJob) error {
 	return nil
 }
 
-// appDataSkipSet returns the source appdata dirs (rsync'd separately) to skip in the merge walk.
+// appDataSkipSet returns the source dirs to prune from the merge walk: the app appdata dirs (rsync'd
+// separately) plus the canonical import root (R-75, never migrates).
 func (m *Manager) appDataSkipSet(j *MigrationJob) map[string]bool {
 	skip := map[string]bool{}
 	for _, app := range j.Apps {
@@ -660,9 +661,25 @@ func (m *Manager) appDataSkipSet(j *MigrationJob) map[string]bool {
 			skip[filepath.Clean(appbackup.AppDataDir(j.SourceNS, name))] = true
 		}
 	}
+	// R-75: the CANONICAL drop-zone lives ONCE, on the system drive, and must never move with an app.
+	// This fires when an app is migrated OFF the system drive: the merge walk would otherwise see
+	// <sysNS>/userdata/import in the source namespace and copy the whole box's drop-zone onto the
+	// destination data drive — creating exactly the second, non-functional drop-zone this arc exists
+	// to remove (and, import being class: excluded, an unbacked one). Migrations off a DATA drive are
+	// unaffected: a data drive has no import root to match.
+	if root := m.GetImportRoot(); root != "" && pathUnder(root, j.SourceNS) {
+		skip[filepath.Clean(root)] = true
+	}
 	return skip
 }
 
+// pathUnder reports whether p is root or lives beneath it. Segment-wise, so a sibling directory
+// sharing a name prefix can never match.
+func pathUnder(p, root string) bool {
+	cp, cr := filepath.Clean(p), filepath.Clean(root)
+	return cp == cr || strings.HasPrefix(cp, cr+string(filepath.Separator))
+}
+
 // RecoverMigration resumes a crashed migration on startup (no-op if none or terminal).
 func (m *Manager) RecoverMigration(ctx context.Context) {
 	j, err := m.loadJournal()