R-67: the NAS share appears in FileBrowser (v0.160.0)

Network shares bind their share ROOT :rslave into FileBrowser — no
skeleton, no userdata scoping, nothing written toward the NAS. Gate is
the stub classifier (stub ⇒ excluded from mounts AND sources — an
exposed stub swallows uploads the real mount later shadows); idle autofs
is healthy and included. Drives byte-identical. Add/remove trigger the
debounced sync. Phase-0 probe on demo-hp: GO (in-container rslave access
wakes the idle trigger). Red-proofs A + B run.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UuFPHmHNrCJj1VhY6QdDMU

controller/README.md

@@ -1309,6 +1309,16 @@ not just those with HDD data. Non-HDD apps can configure destination, method, an
 >     `syncFileBrowserMounts` (system + additional drives); a **deploy belt** in `composeExecCustomEnv`
 >     (on `up`) pre-creates every `${USERDATA_PATH}/...` bind source the app declares, so Docker never
 >     auto-creates a userdata dir as guest-root (covers apps not in the skeleton).
+>   - **NAS shares browse too (v0.160.0, R-67):** a registered network storage binds its share ROOT
+>     into FileBrowser (`/mnt/felhom-drives/<name>:/srv/<name>:rslave`) — no userdata scoping and NO
+>     skeleton (Felhom convention dirs are never written onto a customer's own NAS; the sync is
+>     read-only toward the share). The gate differs from drives: an idle autofs trigger is HEALTHY
+>     and included (first access wakes it — Phase-0-probed through an rslave bind on demo-hp), while
+>     a `stub` classifier verdict (this namespace sees a local dir, not the NAS) EXCLUDES the share
+>     from both the mounts and the source list that pass — uploading into a stub would be silently
+>     shadowed by the real mount later. `unknown` fails open. NAS add-success and remove trigger the
+>     same debounced `SyncFileBrowserMounts`; pure assembly lives in `buildFileBrowserPaths`
+>     (handlers.go) with every edge seamed.
 >   - **FileBrowser** mounts `<drive>/userdata` (was `appdata`) and runs as uid 1000 → it can create
 >     folders + upload into the 2775 setgid tree (fixes the old permission-denied); app internals
 >     (`appdata/`) are no longer browsable. **(v0.66.2)** its entrypoint is wrapped