v0.66.1: inject USERDATA_PATH on first deploy too (shared withUserdataPath)

DeployStack's initial compose-up builds env from deploy values (not stackEnv), so
v0.66.0 missed USERDATA_PATH on first deploy → ${USERDATA_PATH} resolved to '' and
Docker bound a root-owned dir at the container root (found live: radarr /media/movies
was 0:0 755). Shared withUserdataPath injector now used by stackEnv AND
composeExecWithEnv. Regression test included.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/stacks/userdata_belt_test.go

@@ -71,3 +71,26 @@ func TestEnsureUserdataMounts_CreatesBeltDirs(t *testing.T) {
 	}
 	_ = appbackup.SharedContentGID // keep import referenced cross-platform
 }
+
+// TestWithUserdataPath: the shared injector adds USERDATA_PATH=<hdd>/userdata when HDD_PATH is set, and
+// adds nothing when it's empty. Regression for the initial-deploy bug where ${USERDATA_PATH} resolved
+// to "" and bound a bogus root-owned dir at the container root.
+func TestWithUserdataPath(t *testing.T) {
+	got := withUserdataPath([]string{"DOMAIN=x"}, "/mnt/felhom-usb")
+	want := "USERDATA_PATH=" + appbackup.UserdataDir("/mnt/felhom-usb")
+	found := false
+	for _, e := range got {
+		if e == want {
+			found = true
+		}
+	}
+	if !found {
+		t.Errorf("USERDATA_PATH not injected: got %v, want %q", got, want)
+	}
+	// companion: empty HDD_PATH → no USERDATA_PATH at all
+	for _, e := range withUserdataPath([]string{"DOMAIN=x"}, "") {
+		if len(e) >= 13 && e[:13] == "USERDATA_PATH" {
+			t.Errorf("USERDATA_PATH must NOT be set when HDD_PATH is empty: %q", e)
+		}
+	}
+}