v0.41.0: first-boot base-infra bring-up + self-heal (+ Section-G mount fix)

New internal/infra package renders traefik/cloudflared/filebrowser from config
(pinned images, single source of truth; web filebrowser path delegates here).
stacks.EnsureBaseStack deploys the traefik-public network + the three stacks,
single-flight + idempotent + non-fatal; wired to first boot and every health
tick. monitor.EffectiveProtected drops cloudflared when no tunnel token.
Section-G fix lives in felhom-agent build-golden.sh (same-path stacks bind).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/stacks/manager.go

@@ -83,7 +83,8 @@ type Manager struct {
 	composeCmd string
 	stacks     map[string]*Stack
 	mu         sync.RWMutex
-	encKey     []byte // AES-256 key for encrypting sensitive values in app.yaml
+	encKey     []byte     // AES-256 key for encrypting sensitive values in app.yaml
+	infraMu    sync.Mutex // single-flight guard for EnsureBaseStack (base-infra bring-up/self-heal)
 }
 
 // NewManager creates a new stack manager.