v0.128.0: chunked browser .fab upload on /import (tunnel-proof)

Cloudflare edge caps request bodies (~100 MB, probed live: 120 MiB -> edge 413,
80 MiB -> origin), so the client slices the file into 64 MiB strictly-sequential
chunks; the server streams each to a .part file in the default drive's exports
dir and finalize renames atomically. Scan/validate/import pipeline untouched.
upload/{init,chunk,finalize,abort} inside ServeExportAPI (inherits auth+CSRF);
single-flight; offset==received or 409+echo; free-space gate; collision ->
lowest-free "name (N).fab"; startup GC of *.part-*; 15-min idle abort.
appexport.DiskFree exported (seam web.uploadDiskFree). Scenarios A-F tested,
red-proofs run (traversal / out-of-order / overwrite).

controller/cmd/controller/main.go

@@ -863,6 +863,9 @@ func main() {
 	stackMgr.RecoverMigration(ctx)
 	webServer.SetEncryptionKey(encKey)
 	webServer.SetAppExporter(appExporter)
+	// Browser .fab upload (v0.128.0): upload state is in-memory, so a restart strands the .part —
+	// GC stray part files in every registered drive's exports dir at startup.
+	webServer.CleanupStaleUploadParts()
 	// Escrow wizard (v0.127.0): the Scenario-F stale-blob flag feeds the Távoli mentés card.
 	if escrowConfirmer != nil {
 		webServer.SetEscrowStale(escrowConfirmer.StaleBlob)