v0.172.0 — R-75: canonical import root, catalog-derived skeleton, import surfaces

${IMPORT_PATH} = <system namespace root>/userdata/import — ONE drop-zone per box,
on the system drive, injected at BOTH compose-env builders with NO per-drive
fallback (unresolvable leaves it unset so compose fails loudly rather than
quietly building a second, dead drop-zone).

Third BindRoot (RootImport) + Import list in BackupSpec, extended through
ValidateBackupSpec/ClassifyBinds. Load-bearing: a stale `userdata: import/<app>`
entry against the moved bind would be a WHOLE-BLOCK reject, taking the app's
mandatory hdd classification with it.

Exhaustive-root audit: resolveAbs/structuralGuard/ComputeCaptureSet/
ComputeFabBuckets now take importRoot explicitly (an import bind resolved
against hddPath would name a directory on the wrong drive); unresolvable is
refused loudly into Skipped. GetImportRoot added to both provider interfaces.

Catalog-derived skeleton: UserdataSkeleton() -> UserdataSkeletonCarry() +
BuildUserdataSkeleton(), SORTED. The carry-list makes zero-removals true by
construction (`documents` is in no catalog app but on both boxes) and is the
fresh-box floor. The sort is not tidiness: the naive map-order derivation
measured 20 distinct outputs from 20 identical runs, which with fbNeedsRecreate
is a fleet-wide FileBrowser restart loop.

One authoritative compose parser: ParseComposeUserdataMounts now delegates to
ParseComposeClassifiableBinds. Import root excluded from per-app migration.

Surfaces: FileBrowser /srv/beolvasas source; app-page "Hova tegyem a fajlokat?"
with PathEscape deep links (never QueryEscape) and class-driven copy;
data_paths: annotation with the Fork-3 asymmetry; system-owned beolvasas SMB
share refused server-side at handler AND store, button omitted in template.

Caught on the way: the sharing template's row struct was function-local, so
adding {{if .System}} would have 500'd every share row. ShareRow is now
package-level and the render test uses the handler's own type.

Tests 915 -> 949, all green. MinAgent unchanged.

controller/internal/web/handlers.go

@@ -636,6 +636,13 @@ func (s *Server) appDetailHandler(w http.ResponseWriter, r *http.Request, slug s
 	data["HasAppInfo"] = found.Meta.HasAppInfo()
 	data["EffectiveSubdomain"] = effectiveSubdomain
 
+	// „Hova tegyem a fájlokat?" (R-75) — deployed apps that declare data_paths only. Set EXPLICITLY,
+	// like every other key here: appDetailHandler does not funnel through baseData, and the v0.150.0
+	// app_export.html bug (a CSRF token rendered where the domain belonged) came from assuming it did.
+	if cards := s.buildDataPathCards(found); len(cards) > 0 {
+		data["DataPathCards"] = cards
+	}
+
 	// Initial auto-generated login (e.g. Crafty writes a random admin password to a file at first
 	// boot). Read it live from the container so the customer doesn't have to dig through logs. Only
 	// for deployed apps that declare an initial_credentials spec; hidden when unreadable.
@@ -2217,13 +2224,29 @@ func (s *Server) syncFileBrowserMounts(resetDBOnChange bool) {
 	storageMounts, configPaths := buildFileBrowserPaths(paths, fbPathDeps{
 		isMount:        system.IsMountPoint,
 		classify:       s.classifyFSPath,
-		ensureSkeleton: appbackup.EnsureUserdataSkeleton,
+		ensureSkeleton: s.ensureUserdataSkeleton,
 		logger:         s.logger,
 	})
 
+	// R-75: the canonical drop-zone is an EXTRA bind, outside the registered-storage-path loop above.
+	// The system drive is deliberately not a registered StoragePath (it would become a customer-visible
+	// drive, a deploy target and a wipe candidate), so it is mounted here explicitly. Ensure the root
+	// first — a source whose path does not exist renders a broken sidebar entry.
+	importSource := false
+	if s.stackMgr != nil {
+		if importRoot := s.stackMgr.GetImportRoot(); importRoot != "" {
+			if err := s.stackMgr.EnsureImportRoot(); err != nil {
+				s.logger.Printf("[WARN] [web] FileBrowser: could not ensure the import root %s: %v", importRoot, err)
+			}
+			storageMounts = append(storageMounts,
+				fmt.Sprintf("      - %s:/srv/%s", importRoot, infra.FileBrowserImportMount))
+			importSource = true
+		}
+	}
+
 	// Generate and write config.yaml (sources + sidebar entries per drive/share)
 	configPath := stackDir + "/config.yaml"
-	fbConfig := generateFileBrowserConfig(configPaths)
+	fbConfig := generateFileBrowserConfig(configPaths, importSource)
 
 	// Capture the current on-disk content BEFORE any writes, so we can detect whether this sync
 	// actually changes anything (F2). The integrations' ReapplyConfigForTarget edits config.yaml
@@ -2382,6 +2405,6 @@ func generateFileBrowserCompose(domain string, storageMounts []string) string {
 
 // generateFileBrowserConfig returns a FileBrowser Quantum config.yaml with a separate source per
 // registered storage path. Delegates to internal/infra (single source of truth).
-func generateFileBrowserConfig(paths []settings.StoragePath) string {
-	return infra.RenderFileBrowserConfig(paths)
+func generateFileBrowserConfig(paths []settings.StoragePath, importSource bool) string {
+	return infra.RenderFileBrowserConfig(paths, importSource)
 }