v0.320.0: FileBrowser is part of the box again; every app says where its login is; a „Fájlok" button

FileBrowser (and traefik, cloudflared, samba) has no app.yaml, so Deployed is false. Since v0.315.0 the
app page read Deployed alone and showed FileBrowser "not installed", with Install and without its login.
A protected infra stack is now installed by definition on the app page (Deployed || Protected, as every
other surface already counted): settings/guide/log tabs, Restart only, no install page, no data tab.
The Install press would have deployed the infra stack as an app: DeployStack and the deploy API now
refuse a protected stack.

In the operator state (the box does not know FileBrowser's password - both demo boxes) the login panel
offers "Új jelszó beállítása": the file browser's own CLI with the server stopped (spiked on demo-hp:
new 200, old 401, users/shares/settings unchanged), verified, stored encrypted, state generated.

Every installed app's settings tab has the login panel with exactly one answer: the box's fields, the
login the app wrote (InitialCreds), or a sentence chosen by the catalog's new app_info.login_kind
(first_visit default, email, none; none behind the family gate says the family sign-in is the login).

"Fájlok ↗" opens the library folder, else the first declared folder, else a media app's first present
drive's media folder. The data tab lists each drive's media folders; a folder whose drive is not bound
into FileBrowser is text, never a link.

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/scripts/i18n_go_keys.json

@@ -260,7 +260,15 @@
     "err.web.meghajto_hasznalatban_formazas": "BORN AS A KEY (v0.318.0, 2026-10-16) -- the server-side refusal to format a whole disk under a registered drive (`16` §6). New.",
     "backup.target.offer_unproven": "BORN AS A KEY (v0.318.0, 2026-10-16) -- the whole-box backup offer for a drive the agent cannot prove is another disk (R-1084, `16` §4); build A's words, no disk-failure promise. New.",
     "storage.belso_tarhely": "BORN AS A KEY (v0.318.0, 2026-10-16) -- the label of the one-disk box's internal data place, registered in the box's language (`16` §5). New.",
-    "err.web.belso_tarhely_eletciklus": "BORN AS A KEY (v0.318.0, 2026-10-16) -- the refusal of eject/decommission/wipe on the internal data place (`16` §5). New."
+    "err.web.belso_tarhely_eletciklus": "BORN AS A KEY (v0.318.0, 2026-10-16) -- the refusal of eject/decommission/wipe on the internal data place (`16` §5). New.",
+    "api.deploy.part_of_box": "BORN AS A KEY (v0.320.0, 2026-10-16) -- the deploy API's refusal for a protected infra stack (part of the box). Pinned by stacks TestDeployStack_RefusesProtectedStack.",
+    "datapath.media.row": "BORN AS A KEY (v0.320.0, 2026-10-16) -- a media app's per-drive folder row, '<folder> — <drive>'. Pinned by web TestAppPage_FilesButtonTarget.",
+    "datapath.media.root": "BORN AS A KEY (v0.320.0, 2026-10-16) -- the name of a drive's media folder on the app page.",
+    "datapath.media.movies": "BORN AS A KEY (v0.320.0, 2026-10-16) -- the movies folder's name on the app page.",
+    "datapath.media.tv": "BORN AS A KEY (v0.320.0, 2026-10-16) -- the TV folder's name on the app page.",
+    "datapath.media.downloads": "BORN AS A KEY (v0.320.0, 2026-10-16) -- a download client's media folder's name on the app page.",
+    "filebrowser.reset_not_operator": "BORN AS A KEY (v0.320.0, 2026-10-16) -- the new-password press refused because the box already knows the file manager's password. Pinned by web TestFileBrowserResetEndpoint_Refusals.",
+    "filebrowser.reset_failed": "BORN AS A KEY (v0.320.0, 2026-10-16) -- the new-password press failed (apply or verify); the state stays operator. Pinned by stacks TestFileBrowserReset_FailedVerifyKeepsOperator."
   },
   "flash.share.already_on": "A megosztás már be van kapcsolva.",
   "flash.share.enable_failed": "A megosztás bekapcsolása nem sikerült.",