fix(files): review round 2, the server — locks the GC and folders read under, the mount check, the old mount name

- GC: the expiry warning marks each file conditionally on the expiry it saw, one commit each (a file
  deleted meanwhile no longer fails the run; one re-timed keeps its fresh expiry unwarned); eviction
  counts the disk again when a candidate was freed meanwhile, so it never evicts for space already free.
- Folders: a retention change locks the folder and its files, and a finishing file reads the retention
  under a share lock, so neither misses the other; a folder delete locks the files it takes home (a
  file moved out meanwhile stays put, one deleted meanwhile no longer fails the delete).
- Upload: the folder is checked before the probe and held only once the job names it.
- Dedup enqueue locks the cached asset, so a release meanwhile yields a fresh one instead of a 500.
- Mount check reads the kernel's mount table instead of comparing devices (the vfs storage driver gave
  a mounted volume the device of /), and only inside a container; the API also logs a fresh, empty
  volume in the library's place.
- Compose files fall back to DOWNLOAD_HOST_PATH; the upgrade notes cover the from-source pull.
- Folder routes call owned_or_404 directly.

frontend/src/lib/compose.contract.test.ts

@@ -0,0 +1,23 @@
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import { describe, expect, it } from "vitest";
+
+// The compose files an install runs from. The library's host directory was renamed (DOWNLOAD_HOST_PATH
+// → FILES_HOST_PATH); a `.env` that still sets the old name must keep mounting that directory, not a
+// fresh empty volume the app would take for the library. Held here because this lane can read the
+// whole repository; the backend's test lane sees only backend/.
+const REPO = fileURLToPath(new URL("../../../", import.meta.url));
+const COMPOSE = [
+  "docker-compose.yml",
+  "docker-compose.selfhost.yml",
+  "docker-compose.home.yml.example",
+];
+
+describe("compose files · the library mount", () => {
+  it.each(COMPOSE)("%s falls back to the old host-path name on every service", (file) => {
+    const text = readFileSync(REPO + file, "utf8");
+    const mounts = text.match(/^\s*- .*:\/files\s*$/gm) ?? [];
+    expect(mounts.length).toBe(2); // the API and the worker
+    for (const m of mounts) expect(m).toContain("${FILES_HOST_PATH:-${DOWNLOAD_HOST_PATH:-");
+  });
+});