fix(filezilla): set restart: unless-stopped and canonicalize the stack

The filezilla container on vm-esh-nas shipped with no restart policy. It
was SIGTERMed during the 2026-08-18 host shutdown and never came back,
staying down four days while dockge/dozzle-agent/beszel-agent all
recovered on their own.

- add `restart: unless-stopped` (applied on the host, container recreated
  and verified serving 200 on :5800 with all four /NAS mounts visible)
- promote the previously un-canonicalized compose into stacks/filezilla/
  so the policy is version-controlled rather than host-only
- record the missing-restart-policy failure mode in the host README

stacks/filezilla/README.md

@@ -0,0 +1,57 @@
+# filezilla
+
+Web-based FileZilla (`jlesage/filezilla` — VNC-in-the-browser wrapper around
+the desktop client) used to move files in and out of the ESH NAS shares.
+Reachable at `http://10.0.50.154:5800`.
+
+**Deploys to:**
+- **vm-esh-nas** (10.0.50.154) — the only host that bind-mounts the ESH NAS
+  shares directly, which is the whole point of running it here.
+
+## Why this host
+
+The four `/mnt/{share,music,books,media}` bind mounts are hard NFS mounts from
+the Debian NAS at `10.0.50.50`. `vm-esh-nas` is the NAS-adjacent Docker host
+that carries them, so FileZilla sees the shares as local paths under `/NAS/`
+inside the container. Running it anywhere else would mean nested remote hops.
+
+## Mounts
+
+| host path | container path | notes |
+|---|---|---|
+| `/home/user` | `/storage` | local scratch/landing dir |
+| `/docker/appdata/filezilla` | `/config` | app state — site manager, layout, locale |
+| `/mnt/share` | `/NAS/share` | NFS from 10.0.50.50 |
+| `/mnt/music` | `/NAS/music` | NFS from 10.0.50.50 (currently empty) |
+| `/mnt/books` | `/NAS/books` | NFS from 10.0.50.50 |
+| `/mnt/media` | `/NAS/media` | NFS from 10.0.50.50 |
+
+`PUID`/`PGID` are `2000` — match the ownership on the NAS exports, not the
+host's `lkraven` uid.
+
+## Deploy
+
+```bash
+scripts/deploy-stack.sh vm-esh-nas filezilla --compose
+ssh lkraven@10.0.50.154 'cd /opt/docker/compose/filezilla && docker compose config && docker compose up -d'
+```
+
+Verify:
+
+```bash
+ssh lkraven@10.0.50.154 'curl -s -o /dev/null -w "%{http_code}\n" http://127.0.0.1:5800/'   # expect 200
+ssh lkraven@10.0.50.154 'docker exec filezilla ls -1 /NAS'                                   # expect books media music share
+```
+
+## Gotchas
+
+- **Confirm the NFS mounts before `up -d`.** Docker silently fabricates an
+  empty directory for a missing bind source, so a container that starts fine
+  can present four empty `/NAS/*` dirs if `10.0.50.50` is unreachable. Check
+  `findmnt -t nfs,nfs4` on the host first.
+- **`restart: unless-stopped` is load-bearing.** The container originally
+  shipped with no restart policy and silently stayed down for four days after
+  the 2026-08-18 host reboot while every other container on the box came back.
+- **App state lives in `/docker/appdata/filezilla`, not a named volume** —
+  recreating the container preserves site-manager entries, but wiping that
+  path loses them.