docs: R-67 SHIPPED (coupled to R-64) + NAS doc Browsing (FileBrowser) section

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UuFPHmHNrCJj1VhY6QdDMU

documentation/controller/network-storage-nas.md

@@ -118,6 +118,21 @@ with a hint; the rollback still runs.
   **Beállítások → Rendszer → „Hálózat"** card (Helyi cím) — both live-computed per render, never
   stored (S-5), so they are current by construction.
 
+## Browsing (FileBrowser) — R-67, controller v0.160.0
+
+A registered share is browsable in FileBrowser: the sync binds the share ROOT
+(`/mnt/felhom-drives/<name>:/srv/<name>:rslave`) and adds a sidebar source named by the share's
+display label. The `:rslave` propagation is load-bearing — host-side automount wake and
+idle-unmount events reach the running container, and an in-container access through the bind
+WAKES an idle trigger (Phase-0-probed live on demo-hp, 2026-07-22). Differences from drives, both
+deliberate: there is **no userdata scoping and no skeleton** (Felhom convention dirs are never
+written onto a customer's own NAS; the sync is read-only toward the share), and the gate is not
+the drive-absent check (idle is healthy) but the **stub classifier**: when this namespace sees a
+local stub dir instead of the NAS, the share is **excluded from FileBrowser until propagation
+recovers** — an exposed stub would accept uploads that the real mount later shadows, silently
+hiding the customer's files. A dead NAS surfaces as a fast clean error in FileBrowser (the
+soft/retry=0 mount recipe), and recovery after the NAS returns needs no intervention.
+
 ## Health model
 
 Per-share liveness (`ok | idle | unreachable | stub`): `idle` (automount idle-unmounted) is the