after_start deploy fields: asked after the start by this controller, still required for older ones (R-1028/R-1045, security review of catalog 0188430)

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/stacks/media_library_test.go

@@ -1,6 +1,8 @@
 package stacks
 
 import (
+	"gopkg.in/yaml.v3"
+
 	"os"
 	"path/filepath"
 	"strings"
@@ -169,3 +171,19 @@ func TestR1031_MediaAppIsNotAskedForADrive(t *testing.T) {
 		t.Fatal("an app without the marker must still be asked for its drive")
 	}
 }
+
+// R-1028/R-1045: an `after_start` field (Plex's claim code) is not in this controller's wizard and may be empty here;
+// the same template stays REQUIRED for an older controller (it ignores the key). COMPANION RED-PROOF: drop the
+// AfterStart skip in UserFacingFields → this test fails. Restored.
+func TestAfterStartField_NotAskedAtInstall(t *testing.T) {
+	m := Metadata{DeployFields: []DeployField{{EnvVar: "PLEX_CLAIM", Type: "text", Required: true, AfterStart: true}, {EnvVar: "SUBDOMAIN", Type: "subdomain"}}}
+	for _, f := range m.UserFacingFields() {
+		if f.EnvVar == "PLEX_CLAIM" {
+			t.Fatal("the claim code is asked at install — the 4-minute race is back (R-1028)")
+		}
+	}
+	var meta Metadata
+	if err := yaml.Unmarshal([]byte("deploy_fields:\n  - env_var: PLEX_CLAIM\n    type: text\n    required: true\n    after_start: true\n"), &meta); err != nil || !meta.DeployFields[0].AfterStart || !meta.DeployFields[0].Required {
+		t.Fatalf("the template shape must parse as required + after_start: %+v %v", meta.DeployFields, err)
+	}
+}