FileBrowser is published only after its default login is checked (R-1126); the memory refusal says what to do (R-1125)

R-1126 (D11 = A): FileBrowser starts off traefik-public, on its own network felhom-filebrowser; the controller joins it
there, checks this run's default login, and only then puts FileBrowser on traefik-public (files.<domain> served).
FileBrowser's own admin-password setting re-applies at every start (1.5.6 cmd/user.go:50-57, measured on 9202), so it
cannot carry the box's password without overwriting the household's own. Tests red-proved.
R-1125 (D10 = A): err.stacks.not_enough_memory says the memory is held by the installed apps and to remove one or use
a machine with more memory (HU + EN, reworded on purpose). TestR1125_NotEnoughMemorySaysWhatToDo, red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/infra/infra.go

@@ -188,6 +188,10 @@ func RenderCloudflared(d CloudflaredData) (map[string]FileSpec, error) {
 // RenderFileBrowserCompose returns FileBrowser's docker-compose.yml for the given domain and storage
 // volume-mount lines. Ported verbatim from internal/web/handlers.go (the single source of truth now
 // lives here so the pinned image can't diverge between bring-up and the web storage-sync path).
+// FileBrowserNetwork is FileBrowser's own network (R-1126): the controller joins it to check the default login before
+// FileBrowser is put on traefik-public.
+const FileBrowserNetwork = "felhom-filebrowser"
+
 func RenderFileBrowserCompose(domain string, storageMounts []string, groupAdd ...int) string {
 	// R-691 (v0.275.0): supplementary groups — the owning groups of kept folders the view must READ (a
 	// 0770 folder another user owns, e.g. nextcloud's www-data). Their binds are `:ro`. Absent → the
@@ -225,8 +229,12 @@ services:
     volumes:
       - filebrowser_data:/home/filebrowser/data
       - ./config.yaml:/home/filebrowser/config.yaml:ro%s
+    # R-1126 (D11 = A): NOT on traefik-public at start. The box joins it to traefik-public only after it has checked
+    # THIS run's default login is refused (stacks.ensureFileBrowserPublic), so files.<domain> never answers with
+    # FileBrowser's default password — a re-created container always starts unreachable from outside. The box reaches
+    # it for that check over its own network.
     networks:
-      - traefik-public
+      - %s
     deploy:
       resources:
         limits:
@@ -249,9 +257,9 @@ volumes:
   filebrowser_data:
 
 networks:
-  traefik-public:
-    external: true
-`, domain, FileBrowserImage, groupSection, storageSection, domain)
+  %s:
+    name: %s
+`, domain, FileBrowserImage, groupSection, storageSection, FileBrowserNetwork, domain, FileBrowserNetwork, FileBrowserNetwork)
 }
 
 // RenderControllerRoute returns a traefik file-provider dynamic config routing the controller's own