FileBrowser is published only after its default login is checked (R-1126); the memory refusal says what to do (R-1125)

R-1126 (D11 = A): FileBrowser starts off traefik-public, on its own network felhom-filebrowser; the controller joins it
there, checks this run's default login, and only then puts FileBrowser on traefik-public (files.<domain> served).
FileBrowser's own admin-password setting re-applies at every start (1.5.6 cmd/user.go:50-57, measured on 9202), so it
cannot carry the box's password without overwriting the household's own. Tests red-proved.
R-1125 (D10 = A): err.stacks.not_enough_memory says the memory is held by the installed apps and to remove one or use
a machine with more memory (HU + EN, reworded on purpose). TestR1125_NotEnoughMemorySaysWhatToDo, red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/infra/infra_test.go

@@ -247,3 +247,22 @@ func TestFileBrowserRender(t *testing.T) {
 		t.Errorf("filebrowser compose missing the umask-002 entrypoint wrapper: %q", compose)
 	}
 }
+
+// R-1126 (D11 = A): FileBrowser starts OFF traefik-public — the box joins it there only after this run's default login
+// is checked — and on its own network, which the controller joins for that check. The Traefik labels stay, so the route
+// appears the moment the box joins it. RED-PROOF: the service back on traefik-public → this fails.
+func TestFileBrowserRender_R1126_NotPublicAtStart(t *testing.T) {
+	compose := RenderFileBrowserCompose("demo-felhom.eu", nil)
+	svc := compose[strings.Index(compose, "  filebrowser:"):strings.Index(compose, "\nvolumes:")]
+	nets := svc[strings.Index(svc, "    networks:"):]
+	nets = nets[:strings.Index(nets, "    deploy:")]
+	if strings.Contains(nets, "traefik-public") {
+		t.Fatalf("FileBrowser starts on traefik-public — it would be served before its default login is checked:\n%s", nets)
+	}
+	if !strings.Contains(nets, "- "+FileBrowserNetwork) || !strings.Contains(compose, "name: "+FileBrowserNetwork) {
+		t.Fatalf("FileBrowser must sit on %s (named), got:\n%s", FileBrowserNetwork, compose)
+	}
+	if !strings.Contains(compose, "traefik.docker.network=traefik-public") || !strings.Contains(compose, "Host(`files.demo-felhom.eu`)") {
+		t.Fatal("the Traefik labels must stay, so joining traefik-public is all that publishes it")
+	}
+}