v0.326.0: FileBrowser's default password is checked at every FileBrowser start (R-977)

The probe ran once per box; a re-created FileBrowser data volume came back on admin/admin and was never probed
again (measured on scratch 9202 with 0.324.0). Now once per FileBrowser run (its StartedAt): the default found ->
a generated password, verified and stored encrypted; any other password -> nothing changes.
TestFileBrowserAdmin_R977_DefaultBackOnANewRunIsReplaced, red-proved. The comment "before a claim there is no
tunnel" was false and is corrected; the tunnel is not changed.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/manager.go

@@ -279,6 +279,10 @@ type Manager struct {
 	// R-513: FileBrowser admin-password seams (filebrowser_password.go); nil/"" in production.
 	fbHTTP    fbHTTPDo
 	fbBaseURL string
+	// fbStarted replaces the docker read of FileBrowser's StartedAt in tests; fbProbedRun is the run whose default login
+	// was last probed (R-977 — once per FileBrowser run). Touched only under infraMu (the base-stack tick).
+	fbStarted   func() string
+	fbProbedRun string
 	// fbSetPassword replaces the stop / CLI / start sequence of ResetFileBrowserAdminPassword in tests; nil in production.
 	fbSetPassword func(ctx context.Context, password string) error
 	// execFn replaces execCommand's process boundary in tests; nil in production.