v0.320.0: FileBrowser is part of the box again; every app says where its login is; a „Fájlok" button

FileBrowser (and traefik, cloudflared, samba) has no app.yaml, so Deployed is false. Since v0.315.0 the
app page read Deployed alone and showed FileBrowser "not installed", with Install and without its login.
A protected infra stack is now installed by definition on the app page (Deployed || Protected, as every
other surface already counted): settings/guide/log tabs, Restart only, no install page, no data tab.
The Install press would have deployed the infra stack as an app: DeployStack and the deploy API now
refuse a protected stack.

In the operator state (the box does not know FileBrowser's password - both demo boxes) the login panel
offers "Új jelszó beállítása": the file browser's own CLI with the server stopped (spiked on demo-hp:
new 200, old 401, users/shares/settings unchanged), verified, stored encrypted, state generated.

Every installed app's settings tab has the login panel with exactly one answer: the box's fields, the
login the app wrote (InitialCreds), or a sentence chosen by the catalog's new app_info.login_kind
(first_visit default, email, none; none behind the family gate says the family sign-in is the login).

"Fájlok ↗" opens the library folder, else the first declared folder, else a media app's first present
drive's media folder. The data tab lists each drive's media folders; a folder whose drive is not bound
into FileBrowser is text, never a link.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

CHANGELOG.md

@@ -1,3 +1,41 @@
+## v0.320.0 — FileBrowser is part of the box again, every app says where its login is, a „Fájlok" button (2026-10-16)
+
+**MinAgent: 0.158.1** — the floor's, carried from v0.319.0. Nothing here calls the agent. No golden (`09` §3 decision
+250). Design: felhom.eu `architecture/02-controller-module-map.md` „The app page" (`[DESIGN]`). Evidence: felhom.eu
+`audits/logins-folders-2026-10-16/` (P0 diagnosis, P1b spike).
+
+- **FileBrowser regression (since v0.315.0, `e66d466`).** FileBrowser (and traefik, cloudflared, samba) has no app.yaml,
+  so `Deployed` is false; the new app page used `Deployed` alone and showed it „not installed" with „Telepítés" and
+  without its login (the R-513 data only reached the settings tab). A protected infra stack is now installed by
+  definition on the app page (`Deployed || Protected`, as every other surface already counted): settings, guide and log
+  tabs (no data tab, no install page — both 302 to the page), Restart only, the curated name and „Megnyitás ↗" to
+  `files.<domain>`, and a two-line guide.
+- **The Install press could have deployed the infra stack as an app** — `DeployStack` had no protected guard. Refused now
+  in the deploy API (403, before the kept-data check) and in `DeployStack` itself (`ErrProtectedStack`).
+- **„Új jelszó beállítása" for FileBrowser** in the `operator` state (both demo boxes: the box does not know the
+  password). The file browser's own CLI, server stopped (`stacks.ResetFileBrowserAdminPassword`; spiked on demo-hp:
+  new 200, old 401, users/shares/settings unchanged). Verified new=200 and admin/admin refused before the encrypted
+  value is stored and the state set to `generated`; a failed verify leaves `operator`. POST
+  `/apps/filebrowser/initial-credentials/reset`, CSRF, confirm first, logged as an act, value never logged.
+- **One login answer per installed app** — the „Belépés az alkalmazásba" panel is on every installed app, with exactly
+  one answer (`web/app_login.go` `loginAnswerFor`): the box's fields (value on demand, or the no-stored-value sentence) ·
+  the login the app wrote / FileBrowser's (InitialCreds) · a sentence from the catalog's new `app_info.login_kind`:
+  `first_visit` (default), `email`, `none` (behind `family_gate`: the family sign-in is the login). The old separate
+  „Kezdeti belépési adatok" card is now this panel's „initial" answer.
+- **„Fájlok ↗"** in the app header: the library folder, else the first declared folder, else (a media app) the first
+  present drive's `media` folder, built only with `fileBrowserLink`. The data tab lists each drive's media folders for
+  the media apps (`media_library`: Sonarr tv, Radarr movies, the players both, a download client its folder), with no
+  backup sentence (the class there means „not this app's data", not „temporary"). A folder whose drive is not bound
+  into FileBrowser now is text with one WARN, never a link. Under the list: FileBrowser asks for its own password the
+  first time, with a link to its page.
+- Tests red-proved: `web/logins_folders_test.go` (TestAppPage_InfraAppHasNoInstall, _EveryInstalledAppHasOneLoginAnswer,
+  _FilesButtonTarget, _UnknownSourceIsTextNotLink, TestFileBrowserResetEndpoint_Refusals), `stacks/filebrowser_reset_test.go`
+  (TestFileBrowserReset_SetsVerifiesAndStoresEncrypted, _FailedVerifyKeepsOperator, _OnlyInOperatorState,
+  TestDeployStack_RefusesProtectedStack, TestEffectiveLoginKind_DefaultAndUnknown).
+  Parity fixtures: 25 app-page fixtures re-captured (the login panel; the data tab's FileBrowser line); 6 new
+  (`app_settings_infra_filebrowser`, `app_guide_infra_filebrowser`, `app_settings_login_email`, `_login_none`,
+  `_login_family`, `app_data_files_media`). Every other fixture, the install page's included, byte-identical.
+
 ## v0.319.0 — the app page in panels, the login in one place, a password the box never had is said in words (2026-10-16)
 
 **MinAgent: 0.158.1** — the floor's, carried from v0.318.0 (the operator set it there: agent 0.158.0 is superseded by the