v0.66.0: userdata layout + shared-storage ownership convention

appbackup/userdata.go: EnsureUserdataDir (MkdirAll + explicit setgid Chmod 2775 +
chown gid 1000), UserdataSkeleton, EnsureUserdataSkeleton; linux chown/StatGID +
non-linux stubs. stackEnv injects USERDATA_PATH=<HDD_PATH>/userdata. Skeleton
pre-created on register + FileBrowser sync; deploy belt (composeExecCustomEnv on
'up') pre-creates every ${USERDATA_PATH} bind source. FileBrowser mounts userdata
(was appdata) — uid 1000 can now write into 2775 setgid. #8: migrate merge walk +
copyFile preserve source setgid+group so the convention survives MigrateAll.
Non-hollow tests incl. Linux setgid assertions + migration-preserve companion.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

controller/internal/stacks/delete.go

@@ -62,10 +62,10 @@ func ProtectedHDDPaths(hddPath string) map[string]bool {
 	return map[string]bool{
 		// Model A: the in-guest drive mount IS the felhom-data namespace root, so backups/ and
 		// appdata/ sit directly under it (no felhom-data segment).
-		hddPath:                               true,
-		filepath.Join(hddPath, "appdata"):     true,
-		filepath.Join(hddPath, "backups"):     true,
-		filepath.Join(hddPath, "media"):       true,
+		hddPath:                                true,
+		filepath.Join(hddPath, "appdata"):      true,
+		filepath.Join(hddPath, "backups"):      true,
+		filepath.Join(hddPath, "media"):        true,
 		filepath.Join(hddPath, "Dokumentumok"): true,
 		// Legacy pre-Model-A double-nest location; kept protected so any leftover data there is
 		// never wiped by a removal.
@@ -505,6 +505,53 @@ func buildPathInfo(path string) HDDPath {
 	return item
 }
 
+// ParseComposeUserdataMounts reads a docker-compose.yml and extracts the host bind-source paths that
+// reference ${USERDATA_PATH} (resolved to userdataPath) — the dirs the deploy belt must pre-create
+// with the userdata convention. Same scanner shape as ParseComposeHDDMounts.
+func ParseComposeUserdataMounts(composePath, userdataPath string) []string {
+	if userdataPath == "" {
+		return nil
+	}
+	data, err := os.ReadFile(composePath)
+	if err != nil {
+		return nil
+	}
+	var mounts []string
+	seen := make(map[string]bool)
+	scanner := bufio.NewScanner(strings.NewReader(string(data)))
+	inVolumes := false
+	for scanner.Scan() {
+		line := strings.TrimSpace(scanner.Text())
+		if strings.HasPrefix(line, "volumes:") {
+			inVolumes = true
+			continue
+		}
+		if inVolumes && !strings.HasPrefix(line, "-") && !strings.HasPrefix(line, "#") && line != "" {
+			inVolumes = false
+		}
+		if !inVolumes || !strings.HasPrefix(line, "- ") {
+			continue
+		}
+		mountStr := strings.Trim(strings.TrimPrefix(line, "- "), "\"'")
+		parts := strings.SplitN(mountStr, ":", 3)
+		if len(parts) < 2 {
+			continue
+		}
+		hostPath := strings.ReplaceAll(parts[0], "${USERDATA_PATH}", userdataPath)
+		cleanPath := filepath.Clean(hostPath)
+		cleanUD := filepath.Clean(userdataPath)
+		// must be userdataPath itself or a subpath (clean before check — traversal-safe)
+		if cleanPath != cleanUD && !strings.HasPrefix(cleanPath, cleanUD+string(filepath.Separator)) {
+			continue
+		}
+		if !seen[cleanPath] {
+			seen[cleanPath] = true
+			mounts = append(mounts, cleanPath)
+		}
+	}
+	return mounts
+}
+
 // ParseComposeHDDMounts reads a docker-compose.yml and extracts host paths
 // that reference the HDD path from volume bind mounts.
 func ParseComposeHDDMounts(composePath, hddPath string) []string {