0dcbea90b2
ensureSamba joins EnsureBaseStack after filebrowser, gated on SMB.Enabled (cloudflared conditional precedent); reconcile is idempotent (unchanged config + running container = ZERO compose calls, asserted via seam). Atomic tmp+fsync+ rename config writes. Password applied via smbpasswd on STDIN (never argv/log/ settings). Disable = compose down, volumes + folders KEPT. samba added to IsProtectedStack in code (controller.yaml is golden-generated and predates it), which also makes the app-backup loops correctly skip it.