v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

${IMPORT_PATH} = <system namespace root>/userdata/import — ONE drop-zone per box,
on the system drive, injected at BOTH compose-env builders with NO per-drive
fallback (unresolvable leaves it unset so compose fails loudly rather than
quietly building a second, dead drop-zone).

Third BindRoot (RootImport) + Import list in BackupSpec, extended through
ValidateBackupSpec/ClassifyBinds. Load-bearing: a stale `userdata: import/<app>`
entry against the moved bind would be a WHOLE-BLOCK reject, taking the app's
mandatory hdd classification with it.

Exhaustive-root audit: resolveAbs/structuralGuard/ComputeCaptureSet/
ComputeFabBuckets now take importRoot explicitly (an import bind resolved
against hddPath would name a directory on the wrong drive); unresolvable is
refused loudly into Skipped. GetImportRoot added to both provider interfaces.

Catalog-derived skeleton: UserdataSkeleton() -> UserdataSkeletonCarry() +
BuildUserdataSkeleton(), SORTED. The carry-list makes zero-removals true by
construction (`documents` is in no catalog app but on both boxes) and is the
fresh-box floor. The sort is not tidiness: the naive map-order derivation
measured 20 distinct outputs from 20 identical runs, which with fbNeedsRecreate
is a fleet-wide FileBrowser restart loop.

One authoritative compose parser: ParseComposeUserdataMounts now delegates to
ParseComposeClassifiableBinds. Import root excluded from per-app migration.

Surfaces: FileBrowser /srv/beolvasas source; app-page "Hova tegyem a fajlokat?"
with PathEscape deep links (never QueryEscape) and class-driven copy;
data_paths: annotation with the Fork-3 asymmetry; system-owned beolvasas SMB
share refused server-side at handler AND store, button omitted in template.

Caught on the way: the sharing template's row struct was function-local, so
adding {{if .System}} would have 500'd every share row. ShareRow is now
package-level and the render test uses the handler's own type.

Tests 915 -> 949, all green. MinAgent unchanged.

controller/internal/web/filebrowser_network_test.go

@@ -78,7 +78,7 @@ func TestFileBrowserNetworkShareIncluded(t *testing.T) {
 		t.Errorf("skeleton calls = %v, want exactly [%s] — a skeleton toward the NAS writes Felhom convention dirs onto the customer's own NAS", calls, drive.Path)
 	}
 	// Config has both sources, share named by its display label.
-	cfg := infra.RenderFileBrowserConfig(cfgPaths)
+	cfg := infra.RenderFileBrowserConfig(cfgPaths, false)
 	for _, m := range []string{`- path: "/srv/hdd_1"`, `- path: "/srv/Felhom-Share"`, `name: "Felhom Share"`} {
 		if !strings.Contains(cfg, m) {
 			t.Errorf("config missing %q:\n%s", m, cfg)
@@ -104,7 +104,7 @@ func TestFileBrowserNetworkStubExcluded(t *testing.T) {
 	if len(mounts) != 1 || strings.Contains(mounts[0], "Felhom-Share") {
 		t.Errorf("stub share leaked into mounts: %v", mounts)
 	}
-	cfg := infra.RenderFileBrowserConfig(cfgPaths)
+	cfg := infra.RenderFileBrowserConfig(cfgPaths, false)
 	if strings.Contains(cfg, "Felhom-Share") {
 		t.Errorf("stub share leaked into the source list:\n%s", cfg)
 	}
@@ -150,8 +150,8 @@ func TestFileBrowserNetworkRemoval(t *testing.T) {
 
 	oldCompose := infra.RenderFileBrowserCompose("example.hu", withMounts)
 	newCompose := infra.RenderFileBrowserCompose("example.hu", withoutMounts)
-	oldCfg := infra.RenderFileBrowserConfig(withCfg)
-	newCfg := infra.RenderFileBrowserConfig(withoutCfg)
+	oldCfg := infra.RenderFileBrowserConfig(withCfg, false)
+	newCfg := infra.RenderFileBrowserConfig(withoutCfg, false)
 
 	if strings.Contains(newCompose, "Felhom-Share") || strings.Contains(newCfg, "Felhom-Share") {
 		t.Error("removed share left a trace in the renders")