kept data: the choice at reinstall, the list, the read-only view, the load (09 decision 36); R-690 fixed

An install over an app's kept drive folder (appdata/<app> non-empty) asks the household:
"use my kept data" (a load from the newest copy of THIS drive's install, own unit or
second-drive mirror, then the template's after_load) or "start fresh" (the folder is
renamed into <drive>/kept/<app>/<date>/ with the removed app's unit; nothing deleted).
The install API answers 409 kept_data_choice until one is chosen; DeployStack refuses
too. New page Megorzott adatok / Kept data (/kept-data): Load / Look / Delete (typed
confirmation, the only deletion of kept data). FileBrowser gets a read-only source.
The drive-full warning names the kept folders. <drive>/kept is protected and outside
every backup leg.

R-690: the removed-app restore (R-487) never found a unit on a DATA drive — it asked
GetStackComposePath (true for every catalog app) and restored nextcloud with no env.
Now isStackDeployed; pinned with a production-shaped provider.

Red-proofs: audits/night-2026-09-26/E/redproofs/.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/handlers.go

@@ -3404,8 +3404,16 @@ func (s *Server) syncFileBrowserMounts(resetDBOnChange bool) {
 	}
 
 	// Generate and write config.yaml (sources + sidebar entries per drive/share)
+	// `09` §3 decision 36: the read-only „Megőrzött adatok" source — one `:ro` bind per kept item, and
+	// the source only when there is at least one (a source with no mount is a broken sidebar entry, R-67).
+	keptLabel := ""
+	if kb := s.keptFileBrowserBinds(); len(kb) > 0 {
+		storageMounts = append(storageMounts, kb...)
+		keptLabel = s.msgLang(s.boxLang(), "kept.fb_source")
+	}
+
 	configPath := stackDir + "/config.yaml"
-	fbConfig := generateFileBrowserConfig(configPaths, importSource)
+	fbConfig := infra.RenderFileBrowserConfigKept(configPaths, importSource, keptLabel)
 
 	// Capture the current on-disk content BEFORE any writes, so we can detect whether this sync
 	// actually changes anything (F2). The integrations' ReapplyConfigForTarget edits config.yaml