R-977: a new FileBrowser run is given ~20 s to answer in the same tick

rc.1 on 9202: the tick that brought FileBrowser back probed it while it was starting; the default login stayed
open for one 5-minute round. TestFileBrowserAdmin_R977_NewRunIsWaitedForInTheSameTick, red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/filebrowser_password.go

@@ -92,6 +92,15 @@ func (m *Manager) fbStartedAt() string {
 	return strings.TrimSpace(string(out))
 }
 
+// fbProbeWait is the pause between two probes of a new FileBrowser run: 2 s in production, 1 ms against a test
+// FileBrowser.
+func (m *Manager) fbProbeWait() time.Duration {
+	if m.fbHTTP != nil || m.fbBaseURL != "" {
+		return time.Millisecond
+	}
+	return 2 * time.Second
+}
+
 // EnsureFileBrowserAdminPassword probes FileBrowser's default login once per FileBrowser run (R-977) and replaces it
 // when it works. Safe to call every tick: a run already probed returns at once. Returns an error only for logging.
 func (m *Manager) EnsureFileBrowserAdminPassword() error {
@@ -110,7 +119,26 @@ func (m *Manager) EnsureFileBrowserAdminPassword() error {
 	}
 	now := time.Now().UTC().Format(time.RFC3339)
 
-	token, code, err := fbLogin(do, base, "admin")
+	// A NEW run is usually seconds old — the same tick that brought FileBrowser back calls this right after — so it is
+	// given ~20 s to answer before the probe gives up until the next tick (measured on 9202 2026-10-17: without the
+	// wait, a re-created FileBrowser kept its default login for one whole base-stack round, 5 minutes). A run already
+	// probed, or one that cannot be told, gets one try, as before.
+	tries := 1
+	if run != "" && run != m.fbProbedRun {
+		tries = 10
+	}
+	var token string
+	var code int
+	var err error
+	for i := 0; i < tries; i++ {
+		token, code, err = fbLogin(do, base, "admin")
+		if err == nil && (code == http.StatusOK || code == http.StatusUnauthorized || code == http.StatusForbidden) {
+			break
+		}
+		if i+1 < tries {
+			time.Sleep(m.fbProbeWait())
+		}
+	}
 	if err != nil {
 		return fmt.Errorf("filebrowser admin probe: %w (will retry)", err)
 	}