kept data: the choice at reinstall, the list, the read-only view, the load (09 decision 36); R-690 fixed

An install over an app's kept drive folder (appdata/<app> non-empty) asks the household:
"use my kept data" (a load from the newest copy of THIS drive's install, own unit or
second-drive mirror, then the template's after_load) or "start fresh" (the folder is
renamed into <drive>/kept/<app>/<date>/ with the removed app's unit; nothing deleted).
The install API answers 409 kept_data_choice until one is chosen; DeployStack refuses
too. New page Megorzott adatok / Kept data (/kept-data): Load / Look / Delete (typed
confirmation, the only deletion of kept data). FileBrowser gets a read-only source.
The drive-full warning names the kept folders. <drive>/kept is protected and outside
every backup leg.

R-690: the removed-app restore (R-487) never found a unit on a DATA drive — it asked
GetStackComposePath (true for every catalog app) and restored nextcloud with no env.
Now isStackDeployed; pinned with a production-shaped provider.

Red-proofs: audits/night-2026-09-26/E/redproofs/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/infra/infra.go

@@ -34,6 +34,9 @@ const (
 	// template is /files/{encodeURIComponent(name)}/... (SPIKE P2). Accents round-trip correctly —
 	// the spike verified an accented, spaced and ampersand'd source name end to end.
 	FileBrowserImportLabel = "Beolvasás"
+	// FileBrowserKeptMount is the in-container folder NAME of the read-only „Megőrzött adatok" source
+	// (`09` §3 decision 36): each kept item is its own `:ro` bind under /srv/<this>/.
+	FileBrowserKeptMount = "megorzott"
 	// SambaImage is our own pinned LAN-sharing image (R-7 slice 1). Built by
 	// controller/scripts/build-samba-image.sh from controller/infra-images/samba/. NEVER :latest.
 	SambaImage = "gitea.dooplex.hu/admin/felhom-samba:1.1.0"
@@ -266,6 +269,12 @@ http:
 // storage path (each a named sidebar entry). Empty paths → a single default /srv source. Ported
 // verbatim from internal/web/handlers.go.
 func RenderFileBrowserConfig(paths []settings.StoragePath, importSource bool) string {
+	return RenderFileBrowserConfigKept(paths, importSource, "")
+}
+
+// RenderFileBrowserConfigKept is RenderFileBrowserConfig plus the read-only kept-data source, LAST,
+// named keptLabel ("" = no such source: nothing is kept, or the caller predates it).
+func RenderFileBrowserConfigKept(paths []settings.StoragePath, importSource bool, keptLabel string) string {
 	var sources string
 	// The canonical drop-zone (R-75) is FIRST and is NOT a registered storage path — it is a separate
 	// bind of <system namespace>/userdata/import. Separate rather than nested inside a drive source:
@@ -289,6 +298,10 @@ func RenderFileBrowserConfig(paths []settings.StoragePath, importSource bool) st
 		}
 	}
 
+	if keptLabel != "" {
+		sources += fmt.Sprintf("    - path: %q\n      name: %q\n      config:\n        defaultEnabled: true\n",
+			"/srv/"+FileBrowserKeptMount, keptLabel)
+	}
 	return fmt.Sprintf(`# FileBrowser Quantum — managed by felhom-controller
 # WARNING: This file is auto-generated. Manual edits will be overwritten.