v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

${IMPORT_PATH} = <system namespace root>/userdata/import — ONE drop-zone per box,
on the system drive, injected at BOTH compose-env builders with NO per-drive
fallback (unresolvable leaves it unset so compose fails loudly rather than
quietly building a second, dead drop-zone).

Third BindRoot (RootImport) + Import list in BackupSpec, extended through
ValidateBackupSpec/ClassifyBinds. Load-bearing: a stale `userdata: import/<app>`
entry against the moved bind would be a WHOLE-BLOCK reject, taking the app's
mandatory hdd classification with it.

Exhaustive-root audit: resolveAbs/structuralGuard/ComputeCaptureSet/
ComputeFabBuckets now take importRoot explicitly (an import bind resolved
against hddPath would name a directory on the wrong drive); unresolvable is
refused loudly into Skipped. GetImportRoot added to both provider interfaces.

Catalog-derived skeleton: UserdataSkeleton() -> UserdataSkeletonCarry() +
BuildUserdataSkeleton(), SORTED. The carry-list makes zero-removals true by
construction (`documents` is in no catalog app but on both boxes) and is the
fresh-box floor. The sort is not tidiness: the naive map-order derivation
measured 20 distinct outputs from 20 identical runs, which with fbNeedsRecreate
is a fleet-wide FileBrowser restart loop.

One authoritative compose parser: ParseComposeUserdataMounts now delegates to
ParseComposeClassifiableBinds. Import root excluded from per-app migration.

Surfaces: FileBrowser /srv/beolvasas source; app-page "Hova tegyem a fajlokat?"
with PathEscape deep links (never QueryEscape) and class-driven copy;
data_paths: annotation with the Fork-3 asymmetry; system-owned beolvasas SMB
share refused server-side at handler AND store, button omitted in template.

Caught on the way: the sharing template's row struct was function-local, so
adding {{if .System}} would have 500'd every share row. ShareRow is now
package-level and the render test uses the handler's own type.

Tests 915 -> 949, all green. MinAgent unchanged.

controller/internal/stacks/userdata_belt_test.go

@@ -3,6 +3,8 @@ package stacks
 import (
 	"os"
 	"path/filepath"
+	"slices"
+	"strings"
 	"testing"
 
 	"gitea.dooplex.hu/admin/felhom-controller/internal/appbackup"
@@ -72,11 +74,12 @@ func TestEnsureUserdataMounts_CreatesBeltDirs(t *testing.T) {
 	_ = appbackup.SharedContentGID // keep import referenced cross-platform
 }
 
-// TestWithUserdataPath: the shared injector adds USERDATA_PATH=<hdd>/userdata when HDD_PATH is set, and
+// TestWithPathVars: the shared injector adds USERDATA_PATH=<hdd>/userdata when HDD_PATH is set, and
 // adds nothing when it's empty. Regression for the initial-deploy bug where ${USERDATA_PATH} resolved
 // to "" and bound a bogus root-owned dir at the container root.
-func TestWithUserdataPath(t *testing.T) {
-	got := withUserdataPath([]string{"DOMAIN=x"}, "/mnt/felhom-usb")
+func TestWithPathVars(t *testing.T) {
+	const importRoot = "/mnt/sys_drive/felhom-data/userdata/import"
+	got := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-usb", importRoot)
 	want := "USERDATA_PATH=" + appbackup.UserdataDir("/mnt/felhom-usb")
 	found := false
 	for _, e := range got {
@@ -88,9 +91,39 @@ func TestWithUserdataPath(t *testing.T) {
 		t.Errorf("USERDATA_PATH not injected: got %v, want %q", got, want)
 	}
 	// companion: empty HDD_PATH → no USERDATA_PATH at all
-	for _, e := range withUserdataPath([]string{"DOMAIN=x"}, "") {
-		if len(e) >= 13 && e[:13] == "USERDATA_PATH" {
+	for _, e := range withPathVars([]string{"DOMAIN=x"}, "", importRoot) {
+		if strings.HasPrefix(e, "USERDATA_PATH") {
 			t.Errorf("USERDATA_PATH must NOT be set when HDD_PATH is empty: %q", e)
 		}
 	}
 }
+
+// TestWithPathVars_ImportPath pins the R-75 half. IMPORT_PATH has the SAME failure mode
+// USERDATA_PATH had: a site that forgets it resolves ${IMPORT_PATH} to "" and binds a bogus
+// root-owned dir at the container root. And the unresolvable case must leave the variable UNSET —
+// never fall back to a per-drive path, which would recreate the dead-drop-zone shape R-75 removes.
+func TestWithPathVars_ImportPath(t *testing.T) {
+	const importRoot = "/mnt/sys_drive/felhom-data/userdata/import"
+
+	got := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/hdd_1", importRoot)
+	if !slices.Contains(got, "IMPORT_PATH="+importRoot) {
+		t.Errorf("IMPORT_PATH not injected: got %v", got)
+	}
+	// It is CANONICAL: it must not be derived from HDD_PATH. A second app on a different drive gets
+	// the identical value — that is the whole point of the canonical root.
+	other := withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/nvme-1tb", importRoot)
+	if !slices.Contains(other, "IMPORT_PATH="+importRoot) {
+		t.Errorf("IMPORT_PATH must not vary with HDD_PATH: got %v", other)
+	}
+	for _, e := range got {
+		if strings.HasPrefix(e, "IMPORT_PATH=") && strings.Contains(e, "felhom-drives") {
+			t.Errorf("IMPORT_PATH must never point at a data drive: %q", e)
+		}
+	}
+	// Unresolvable → UNSET (compose then fails loudly on ${IMPORT_PATH}).
+	for _, e := range withPathVars([]string{"DOMAIN=x"}, "/mnt/felhom-drives/hdd_1", "") {
+		if strings.HasPrefix(e, "IMPORT_PATH") {
+			t.Errorf("IMPORT_PATH must NOT be set when the import root is unresolvable: %q", e)
+		}
+	}
+}