v0.66.0: userdata layout + shared-storage ownership convention

appbackup/userdata.go: EnsureUserdataDir (MkdirAll + explicit setgid Chmod 2775 +
chown gid 1000), UserdataSkeleton, EnsureUserdataSkeleton; linux chown/StatGID +
non-linux stubs. stackEnv injects USERDATA_PATH=<HDD_PATH>/userdata. Skeleton
pre-created on register + FileBrowser sync; deploy belt (composeExecCustomEnv on
'up') pre-creates every ${USERDATA_PATH} bind source. FileBrowser mounts userdata
(was appdata) — uid 1000 can now write into 2775 setgid. #8: migrate merge walk +
copyFile preserve source setgid+group so the convention survives MigrateAll.
Non-hollow tests incl. Linux setgid assertions + migration-preserve companion.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/appbackup/userdata_test.go

@@ -0,0 +1,52 @@
+package appbackup
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+// TestSharedContentGID pins the shared content group to 1000 (FileBrowser's gid + the apps' PUID/PGID).
+func TestSharedContentGID(t *testing.T) {
+	if SharedContentGID != 1000 {
+		t.Errorf("SharedContentGID = %d, want 1000", SharedContentGID)
+	}
+}
+
+// TestUserdataSkeleton_List asserts the locked skeleton subdir set.
+func TestUserdataSkeleton_List(t *testing.T) {
+	got := map[string]bool{}
+	for _, s := range UserdataSkeleton() {
+		got[s] = true
+	}
+	for _, want := range []string{
+		"media/movies", "media/tv", "media/music", "media/audiobooks", "media/books",
+		"media/comics", "media/photos", "downloads", "import/paperless", "import/calibre",
+		"roms", "documents",
+	} {
+		if !got[want] {
+			t.Errorf("skeleton missing %q", want)
+		}
+	}
+}
+
+// TestUserdataDir confirms the userdata root is a sibling under the namespace.
+func TestUserdataDir(t *testing.T) {
+	if got := UserdataDir("/mnt/felhom-usb"); got != filepath.Clean("/mnt/felhom-usb/userdata") {
+		t.Errorf("UserdataDir = %q", got)
+	}
+}
+
+// TestEnsureUserdataSkeleton_Structure: every skeleton dir is created (chown may fail off-root, which
+// is ignored — dirs + setgid still land). Runs cross-platform.
+func TestEnsureUserdataSkeleton_Structure(t *testing.T) {
+	ns := t.TempDir()
+	_ = EnsureUserdataSkeleton(ns) // ignore chown error on a non-root CI host
+	base := UserdataDir(ns)
+	for _, sub := range append([]string{""}, UserdataSkeleton()...) {
+		p := filepath.Join(base, sub)
+		if fi, err := os.Stat(p); err != nil || !fi.IsDir() {
+			t.Errorf("skeleton dir missing: %s (%v)", p, err)
+		}
+	}
+}