Traefik v3.7.17 (GHSA-xv5x-242w-7hf7); R-1347 a restore forgets the update-held flag; R-1348 a failed put-back at start-up mails; R-1339, R-1351, R-1323 truthful start-up lines and one lock over FileBrowser's compose. Commit only.

controller/internal/infra/infra.go

@@ -27,8 +27,10 @@ import (
 // notices (felhom.eu R-1304, R-1305; 1.5.7-stable is skipped — it broke existing TOTP sign-ins). Each new image reaches
 // a running box by the reconcile at start: TestEnsureTraefik_ANewImageRecreatesTraefik,
 // TestEnsureCloudflared_ANewImageRecreatesTheTunnel, TestReconcileFileBrowserImage_MovesOnlyTheImage.
+// traefik v3.7.17 since 2026-11-02: GHSA-xv5x-242w-7hf7 (high, v3.7.14–v3.7.16): an unauthenticated client with a
+// Negotiate/NTLM header holds a backend transport per connection until memory runs out, NTLM backend or not.
 const (
-	TraefikImage     = "traefik:v3.7.16"
+	TraefikImage     = "traefik:v3.7.17"
 	CloudflaredImage = "cloudflare/cloudflared:2026.10.4"
 	FileBrowserImage = "gtstef/filebrowser:1.5.8-stable"
 	// FileBrowserImportMount is the in-container mount point NAME for the canonical drop-zone