FileBrowser is published only after its default login is checked (R-1126); the memory refusal says what to do (R-1125)

R-1126 (D11 = A): FileBrowser starts off traefik-public, on its own network felhom-filebrowser; the controller joins it
there, checks this run's default login, and only then puts FileBrowser on traefik-public (files.<domain> served).
FileBrowser's own admin-password setting re-applies at every start (1.5.6 cmd/user.go:50-57, measured on 9202), so it
cannot carry the box's password without overwriting the household's own. Tests red-proved.
R-1125 (D10 = A): err.stacks.not_enough_memory says the memory is held by the installed apps and to remove one or use
a machine with more memory (HU + EN, reworded on purpose). TestR1125_NotEnoughMemorySaysWhatToDo, red-proved.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/infra.go

@@ -94,9 +94,9 @@ func (m *Manager) EnsureBaseStack() error {
 
 	if err := m.ensureFileBrowser(filepath.Join(base, "filebrowser")); err != nil {
 		errs = append(errs, fmt.Sprintf("filebrowser: %v", err))
-	} else if err := m.EnsureFileBrowserAdminPassword(); err != nil {
-		// R-513: one-time; retried every tick until decided. Logged, never fatal to the base stack.
-		m.logger.Printf("[WARN] [infra] %v", err)
+	} else {
+		// R-513 + R-977 + R-1126: check this run's default login, then (only then) publish files.<domain>.
+		m.fileBrowserGateLocked()
 	}
 
 	// samba (LAN network-sharing, R-7) — conditional deploy, same shape as cloudflared: only when the