v0.66.0: userdata layout + shared-storage ownership convention

appbackup/userdata.go: EnsureUserdataDir (MkdirAll + explicit setgid Chmod 2775 +
chown gid 1000), UserdataSkeleton, EnsureUserdataSkeleton; linux chown/StatGID +
non-linux stubs. stackEnv injects USERDATA_PATH=<HDD_PATH>/userdata. Skeleton
pre-created on register + FileBrowser sync; deploy belt (composeExecCustomEnv on
'up') pre-creates every ${USERDATA_PATH} bind source. FileBrowser mounts userdata
(was appdata) — uid 1000 can now write into 2775 setgid. #8: migrate merge walk +
copyFile preserve source setgid+group so the convention survives MigrateAll.
Non-hollow tests incl. Linux setgid assertions + migration-preserve companion.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/appbackup/derivestackname_test.go

@@ -14,8 +14,8 @@ func TestDeriveStackName_KnownCrossRef(t *testing.T) {
 		note      string
 	}{
 		{"romm-postgres", "romm", "role suffix of a real stack → strip"},
-		{"my-cache", "my-cache", "container name IS a real stack → do NOT strip to 'my'"},     // pre-fix: "my"
-		{"my-cache-postgres", "my-cache", "strip role, result is a known stack"},               // pre-fix: "my-cache" (ok) — but via prefix here
+		{"my-cache", "my-cache", "container name IS a real stack → do NOT strip to 'my'"}, // pre-fix: "my"
+		{"my-cache-postgres", "my-cache", "strip role, result is a known stack"},          // pre-fix: "my-cache" (ok) — but via prefix here
 		{"paperless-ngx-postgres", "paperless-ngx", "multi-hyphen stack, role suffix"},
 		{"romm_postgres", "romm", "underscore-separated compose name → longest known prefix"},
 		{"romm-1", "romm", "compose numeric suffix → longest known prefix"},