fix(filezilla): set restart: unless-stopped and canonicalize the stack

The filezilla container on vm-esh-nas shipped with no restart policy. It
was SIGTERMed during the 2026-08-18 host shutdown and never came back,
staying down four days while dockge/dozzle-agent/beszel-agent all
recovered on their own.

- add `restart: unless-stopped` (applied on the host, container recreated
  and verified serving 200 on :5800 with all four /NAS mounts visible)
- promote the previously un-canonicalized compose into stacks/filezilla/
  so the policy is version-controlled rather than host-only
- record the missing-restart-policy failure mode in the host README

servers/vm-esh-nas/README.md

@@ -42,7 +42,8 @@ scripts/refresh-server-info.sh vm-esh-nas
 ## Stack mirror layout
 
 - `stacks-mirror/vm-esh-nas/beszel-agent-esh-nas/` — Beszel agent (canonical in `stacks/beszel/`)
-- Other stacks (`dockge`, `dozzle-agent`, `filezilla`) not yet canonicalized; run `sync-stacks.sh vm-esh-nas` to pull them into the mirror.
+- `filezilla` — canonical in `stacks/filezilla/`
+- Other stacks (`dockge`, `dozzle-agent`) not yet canonicalized; run `sync-stacks.sh vm-esh-nas` to pull them into the mirror.
 
 ## Placement rule
 
@@ -52,6 +53,11 @@ VM. Low RAM ceiling (3.8 GB) — keep heavy workloads elsewhere.
 
 ## Known nits
 
+- **Check restart policies after any reboot of this host.** `dockge`,
+  `dozzle-agent`, and `beszel-agent` carry restart policies; `filezilla` did
+  not, and stayed down silently for four days after the 2026-08-18 reboot
+  (fixed 2026-08-22 — `restart: unless-stopped`). Anything else added here
+  needs the policy set explicitly.
 - `/opt/docker/compose` is world-writable (drwxrwxrwx). Harmless but
   worth tightening at some point.
 - `/opt/docker/conf` doesn't exist yet; stacks that need bind-mounted

stacks/filezilla/README.md

@@ -0,0 +1,57 @@
+# filezilla
+
+Web-based FileZilla (`jlesage/filezilla` — VNC-in-the-browser wrapper around
+the desktop client) used to move files in and out of the ESH NAS shares.
+Reachable at `http://10.0.50.154:5800`.
+
+**Deploys to:**
+- **vm-esh-nas** (10.0.50.154) — the only host that bind-mounts the ESH NAS
+  shares directly, which is the whole point of running it here.
+
+## Why this host
+
+The four `/mnt/{share,music,books,media}` bind mounts are hard NFS mounts from
+the Debian NAS at `10.0.50.50`. `vm-esh-nas` is the NAS-adjacent Docker host
+that carries them, so FileZilla sees the shares as local paths under `/NAS/`
+inside the container. Running it anywhere else would mean nested remote hops.
+
+## Mounts
+
+| host path | container path | notes |
+|---|---|---|
+| `/home/user` | `/storage` | local scratch/landing dir |
+| `/docker/appdata/filezilla` | `/config` | app state — site manager, layout, locale |
+| `/mnt/share` | `/NAS/share` | NFS from 10.0.50.50 |
+| `/mnt/music` | `/NAS/music` | NFS from 10.0.50.50 (currently empty) |
+| `/mnt/books` | `/NAS/books` | NFS from 10.0.50.50 |
+| `/mnt/media` | `/NAS/media` | NFS from 10.0.50.50 |
+
+`PUID`/`PGID` are `2000` — match the ownership on the NAS exports, not the
+host's `lkraven` uid.
+
+## Deploy
+
+```bash
+scripts/deploy-stack.sh vm-esh-nas filezilla --compose
+ssh lkraven@10.0.50.154 'cd /opt/docker/compose/filezilla && docker compose config && docker compose up -d'
+```
+
+Verify:
+
+```bash
+ssh lkraven@10.0.50.154 'curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:5800/'   # expect 200
+ssh lkraven@10.0.50.154 'docker exec filezilla ls -1 /NAS'                                   # expect books media music share
+```
+
+## Gotchas
+
+- **Confirm the NFS mounts before `up -d`.** Docker silently fabricates an
+  empty directory for a missing bind source, so a container that starts fine
+  can present four empty `/NAS/*` dirs if `10.0.50.50` is unreachable. Check
+  `findmnt -t nfs,nfs4` on the host first.
+- **`restart: unless-stopped` is load-bearing.** The container originally
+  shipped with no restart policy and silently stayed down for four days after
+  the 2026-08-18 host reboot while every other container on the box came back.
+- **App state lives in `/docker/appdata/filezilla`, not a named volume** —
+  recreating the container preserves site-manager entries, but wiping that
+  path loses them.

stacks/filezilla/compose.yaml

@@ -0,0 +1,24 @@
+services:
+  filezilla:
+    image: jlesage/filezilla
+    restart: unless-stopped
+    environment:
+      - PUID=2000
+      - PGID=2000
+    volumes:
+      - /home/user:/storage:rw
+      - /docker/appdata/filezilla:/config:rw
+      - /mnt/share:/NAS/share
+      - /mnt/music:/NAS/music
+      - /mnt/books:/NAS/books
+      - /mnt/media:/NAS/media
+    ports:
+      - 5800:5800
+    container_name: filezilla
+    labels:
+      - homepage.group=Apps
+      - homepage.name=FileZilla
+      - homepage.icon=si-filezilla
+      - homepage.description=Web-based FileZilla (vm-esh-nas NFS mounts)
+      - homepage.href=http://10.0.50.154:5800
+networks: {}