v0.66.2: FileBrowser umask 002 via entrypoint wrapper

gtstef/filebrowser is a single Go binary that ignores a UMASK env (verified live:
-e UMASK=002 leaves PID1 0022), so RenderFileBrowserCompose wraps the entrypoint
sh -c 'umask 002; exec /home/filebrowser/filebrowser'. Customer-created folders now
come out 2775 (group-writable) so group-1000 apps can write into them. Test asserts
the wrapper is rendered.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/infra/infra_test.go

@@ -223,4 +223,10 @@ func TestFileBrowserRender(t *testing.T) {
 	if !strings.Contains(withMounts, "/mnt/hdd_1:/srv/hdd_1") {
 		t.Errorf("storage mount not wired into filebrowser compose: %q", withMounts)
 	}
+
+	// v0.66.2: the entrypoint wrapper sets umask 002 so customer-created folders are group-writable
+	// (2775). The image doesn't honor a UMASK env, so this MUST be the entrypoint mechanism.
+	if !strings.Contains(compose, `entrypoint: ["sh", "-c", "umask 002; exec /home/filebrowser/filebrowser"]`) {
+		t.Errorf("filebrowser compose missing the umask-002 entrypoint wrapper: %q", compose)
+	}
 }