v0.66.2: FileBrowser umask 002 via entrypoint wrapper

gtstef/filebrowser is a single Go binary that ignores a UMASK env (verified live:
-e UMASK=002 leaves PID1 0022), so RenderFileBrowserCompose wraps the entrypoint
sh -c 'umask 002; exec /home/filebrowser/filebrowser'. Customer-created folders now
come out 2775 (group-writable) so group-1000 apps can write into them. Test asserts
the wrapper is rendered.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/infra/infra.go

@@ -129,6 +129,11 @@ services:
     image: %s
     container_name: filebrowser
     restart: unless-stopped
+    # umask 002 so folders the customer creates here come out group-writable (2775 with the parent's
+    # setgid), letting the content apps (group 1000) write into them. The gtstef/filebrowser image is a
+    # single Go binary (entrypoint ./filebrowser) and does NOT honor a UMASK env (verified: -e UMASK=002
+    # leaves PID1 at 0022), so we wrap the entrypoint to set the process umask before exec.
+    entrypoint: ["sh", "-c", "umask 002; exec /home/filebrowser/filebrowser"]
     environment:
       - TZ=Europe/Budapest
       - FILEBROWSER_CONFIG=/home/filebrowser/config.yaml