R-977: a new FileBrowser run is given ~20 s to answer in the same tick

rc.1 on 9202: the tick that brought FileBrowser back probed it while it was starting; the default login stayed
open for one 5-minute round. TestFileBrowserAdmin_R977_NewRunIsWaitedForInTheSameTick, red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/filebrowser_password_test.go

@@ -210,3 +210,37 @@ func TestFileBrowserAdmin_R977_DefaultBackOnANewRunIsReplaced(t *testing.T) {
 		t.Fatalf("the recorded decision moved on a run that is not on the default: state=%q", s)
 	}
 }
+
+// R-977, measured live: the tick that brings FileBrowser back probes it while it is still starting, and without a wait
+// the default login stayed open until the next round (5 minutes on 9202). A NEW run is given a short wait.
+// RED-PROOF (2026-10-17): with one try per tick this fails at „the default stayed open".
+func TestFileBrowserAdmin_R977_NewRunIsWaitedForInTheSameTick(t *testing.T) {
+	fb := &fakeFB{password: "admin"}
+	starting := 3 // the first three answers: FileBrowser not ready yet
+	inner := fb.handler()
+	srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		fb.mu.Lock()
+		notReady := starting > 0
+		if notReady {
+			starting--
+		}
+		fb.mu.Unlock()
+		if notReady {
+			w.WriteHeader(http.StatusBadGateway)
+			return
+		}
+		inner.ServeHTTP(w, r)
+	}))
+	defer srv.Close()
+	m, st, _ := fbManager(t, srv.URL)
+	m.fbStarted = func() string { return "2026-10-17T09:24:35Z" }
+	if err := m.EnsureFileBrowserAdminPassword(); err != nil {
+		t.Fatalf("one tick: %v", err)
+	}
+	if _, c, _ := fbLogin(srv.Client().Do, srv.URL, "admin"); c == http.StatusOK {
+		t.Fatal("the default stayed open after the tick that started FileBrowser")
+	}
+	if s, _, _ := st.GetFileBrowserAdmin(); s != settings.FileBrowserAdminGenerated {
+		t.Fatalf("state %q, want generated", s)
+	}
+}