v0.41.0: first-boot base-infra bring-up + self-heal (+ Section-G mount fix)

New internal/infra package renders traefik/cloudflared/filebrowser from config
(pinned images, single source of truth; web filebrowser path delegates here).
stacks.EnsureBaseStack deploys the traefik-public network + the three stacks,
single-flight + idempotent + non-fatal; wired to first boot and every health
tick. monitor.EffectiveProtected drops cloudflared when no tunnel token.
Section-G fix lives in felhom-agent build-golden.sh (same-path stacks bind).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/cmd/controller/main.go

@@ -153,6 +153,17 @@ func main() {
 	// Migrate existing plaintext passwords to encrypted
 	stackMgr.MigrateEncryption()
 
+	// --- First-boot base-infrastructure bring-up ---
+	// We are guaranteed configured here (setup.NeedsSetup returned false above), so deploy the base
+	// stack (traefik-public network → traefik → cloudflared → filebrowser) the controller needs for
+	// routing + external access. Runs in a goroutine so a slow first-boot image pull never delays the
+	// web server; non-fatal (idempotent + single-flight, the health loop re-attempts each tick).
+	go func() {
+		if err := stackMgr.EnsureBaseStack(); err != nil {
+			logger.Printf("[WARN] [infra] first-boot base-stack bring-up: %v", err)
+		}
+	}()
+
 	// --- Initialize catalog syncer ---
 	syncer := catalogsync.New(cfg, logger, stackMgr.ScanStacks, func(updated []string) {
 		stackMgr.InjectMissingFields(updated)
@@ -258,6 +269,15 @@ func main() {
 	}
 	sched.Every("system-health", healthInterval, func(ctx context.Context) error {
 		healthReport := monitor.RunHealthCheck(cfg, cpuCollector, sett.GetStoragePaths(), logger)
+		// Self-heal the base stack: call unconditionally every tick. EnsureBaseStack is single-flight
+		// + idempotent (skips running stacks ⇒ a cheap 3× docker-inspect no-op when healthy), so there
+		// is no need to couple to the health-report issue strings. Runs in a goroutine — never blocks
+		// or fails the health job.
+		go func() {
+			if err := stackMgr.EnsureBaseStack(); err != nil {
+				logger.Printf("[WARN] [infra] self-heal base-stack bring-up: %v", err)
+			}
+		}()
 		// Refresh dashboard alerts from health report
 		updateAvailable := false
 		latestVersion := ""