R-1126: the gate publishes the container it checked, by id (TOCTOU from the commit's security review)

web.SyncFileBrowserMounts can re-create FileBrowser between the check and the connect; a connect by name would publish
the new, unchecked container. The run is now "<id> <StartedAt>" and the connect targets that id.
TestFileBrowserGate_ConnectsTheCheckedContainerById, red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/filebrowser_password.go

@@ -76,8 +76,10 @@ func fbLogin(do fbHTTPDo, base, password string) (string, int, error) {
 	return strings.Trim(strings.TrimSpace(string(b)), `"`), resp.StatusCode, nil
 }
 
-// fbStartedAt identifies FileBrowser's current run (its container's .State.StartedAt); "" when unknown. Tests set
-// fbStarted; with a test FileBrowser (fbHTTP / fbBaseURL) and no fbStarted it is "" — a test never reaches docker.
+// fbStartedAt identifies FileBrowser's current run: "<container id> <.State.StartedAt>" (R-1126: the gate connects that
+// exact container id, so a container re-created between the check and the connect is never published). "" when
+// unknown. Tests set fbStarted; with a test FileBrowser (fbHTTP / fbBaseURL) and no fbStarted it is "" — a test never
+// reaches docker.
 func (m *Manager) fbStartedAt() string {
 	if m.fbStarted != nil {
 		return m.fbStarted()
@@ -85,7 +87,7 @@ func (m *Manager) fbStartedAt() string {
 	if m.fbHTTP != nil || m.fbBaseURL != "" {
 		return ""
 	}
-	out, err := dockerexec.Command("docker", "inspect", "--format", "{{.State.StartedAt}}", fileBrowserContainer).Output()
+	out, err := dockerexec.Command("docker", "inspect", "--format", "{{.Id}} {{.State.StartedAt}}", fileBrowserContainer).Output()
 	if err != nil {
 		return ""
 	}