manifests: pass --config to filebrowser so it reads our ConfigMap

The previous PR pinned filebrowser to v2.63.13 + runAsUser:0 which
solved the PVC permission issue, but the pod was still 0/1 Ready
because v2.63.x changed the default config-file lookup path:

  Old (v2-alpine): /.filebrowser.json (matched our existing mount)
  New (v2.63.13) : /config/settings.json (NOT mounted in this pod)

So the new image ran with its built-in defaults (port 80, in-memory
db), and the readiness probe on 8080/health timed out.

Fix: pass `args: ["-c", "/.filebrowser.json"]` so filebrowser uses the
ConfigMap we already mount there. No volumeMount changes needed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

manifests/umami.yaml

@@ -187,7 +187,7 @@ spec:
               cpu: "50m"
       containers:
         - name: umami
-          image: ghcr.io/umami-software/umami:postgresql-v1.38.0
+          image: ghcr.io/umami-software/umami:3.1.0
           ports:
             - containerPort: 3000
           env:

manifests/webpage.yaml

@@ -105,9 +105,22 @@ spec:
       labels:
         app: filebrowser
     spec:
+      # filebrowser v2.63.13 (debian default) runs as a non-root UID by default
+      # and can't write to PVC files left by the previous v2-alpine image (which
+      # ran as root). Force root explicitly so the existing PVC contents are
+      # readable + writable. (The alternative -- chown the PVC then drop perms --
+      # needs a one-shot initContainer; not worth the moving parts here.)
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
       containers:
         - name: filebrowser
           image: filebrowser/filebrowser:v2.63.13
+          # v2.63.x default config path is `/config/settings.json`; our ConfigMap
+          # is mounted at `/.filebrowser.json`. Tell filebrowser to read it
+          # explicitly so it picks up port 8080 (else it falls back to port 80
+          # and the readiness probe on 8080 fails).
+          args: ["-c", "/.filebrowser.json"]
           ports:
             - containerPort: 8080
           volumeMounts: