Fix filebrowser: persist database and allow port 80 bind

The image switched to the FILEBROWSER_* env scheme and now runs as
non-root (uid 1000), which broke two things:

- It binds :80 inside the container, which a non-root user may not do
  ("bind: permission denied" since the Jul 19 reboot). Allow it via
  net.ipv4.ip_unprivileged_port_start=0 instead of running as root.
- It stores DB/config under /home/filebrowser/data, not /config, so the
  old FB_DATABASE + /config mount were ignored and the database lived
  inside the container (lost on every restart). Mount the host dir there
  and give it to uid 1000.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

modules/fileserver.nix

@@ -147,8 +147,9 @@
     "d /data/backup 0775 root root -"
     "d /data/backup/timemachine 0775 danlin users -"
     
-    # FileBrowser config
+    # FileBrowser config — muss dem Container-User (uid 1000) gehören,
-    "d /data/filebrowser 0755 root root -"
+    # das Image läuft non-root als filebrowser:1000.
+    "d /data/filebrowser 0755 danlin users -"
 
     # Secrets
     "d /data/secrets 0700 root root -"
@@ -167,13 +168,17 @@
     ports = [ "8080:80" ];
     volumes = [
       "/data:/srv"
-      "/data/filebrowser:/config"
+      # Das Image legt DB + config.yaml unter /home/filebrowser/data ab
+      # (FILEBROWSER_DATABASE/-CONFIG). Ohne diesen Mount lebt die Datenbank
+      # nur im Container und ist nach jedem Neustart weg.
+      "/data/filebrowser:/home/filebrowser/data"
     ];
     environment = {
       TZ = "Europe/Berlin";
-      FB_DATABASE = "/config/filebrowser.db";
     };
     environmentFiles = [ "/data/secrets/filebrowser.env" ];
+    # Läuft als non-root (uid 1000) und dürfte Port 80 sonst nicht binden.
+    extraOptions = [ "--sysctl" "net.ipv4.ip_unprivileged_port_start=0" ];
   };
 
   virtualisation.oci-containers.containers.gitea = {