fix(M25): atomic.Pointer for Server.integrationMgr (constructor-goroutine race)

NewServer launches the SyncFileBrowserMounts goroutine (reads integrationMgr)
from the constructor, BEFORE main.go's SetIntegrationManager write — so the
init-only happens-before that covers the other Set* fields does NOT hold here,
making it a genuine data race (handlers.go:358/360/1433 reads vs server.go:162
write). Converted the field to atomic.Pointer[integrations.Manager]; setter
Stores, all 3 readers Load(). Regression test reproduces the concurrent access
(clean under -race; flags on the pre-fix plain-pointer field).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/web/server.go

@@ -10,6 +10,7 @@ import (
 	"path/filepath"
 	"strings"
 	"sync"
+	"sync/atomic"
 	"time"
 
 	"gitea.dooplex.hu/admin/felhom-controller/internal/appexport"
@@ -56,8 +57,12 @@ type Server struct {
 	// Asset syncer for Hub-managed assets (optional)
 	assetsSyncer *assets.Syncer
 
-	// App-to-app integration manager (optional)
-	integrationMgr *integrations.Manager
+	// App-to-app integration manager (optional).
+	// M25: atomic because the constructor launches the SyncFileBrowserMounts
+	// goroutine (which reads this) BEFORE SetIntegrationManager runs in main.go —
+	// so a plain field would be a data race (the init-only happens-before that
+	// covers the other Set* fields does NOT hold for this one).
+	integrationMgr atomic.Pointer[integrations.Manager]
 
 	// App export/import engine (optional)
 	appExporter *appexport.Exporter
@@ -159,7 +164,7 @@ func (s *Server) SetAssetsSyncer(as *assets.Syncer) {
 
 // SetIntegrationManager sets the app-to-app integration manager.
 func (s *Server) SetIntegrationManager(mgr *integrations.Manager) {
-	s.integrationMgr = mgr
+	s.integrationMgr.Store(mgr)
 }
 
 // SetLogBuffer sets the in-memory log ring buffer for the debug log viewer.