chore(albok-service): deploy 0.1.14 on nh3-albok (unit 4.3 write side + browse view, detector 2; albok-dev ask 8524)

stacks/albok-service/README.md

@@ -8,7 +8,24 @@ The FastAPI process that owns Albok's buildings-and-wings store (`vh/albok`,
   (`servers/nh3-albok/README.md` says why and what must never be added there). Before that: nh3-docker, 2026-10-02 to 2026-10-04.
 - **URL:** `http://albok.nh3.internal:8392` (= `http://10.100.50.44:8392`). Container port 8390.
   Host port **8392** is kept from nh3-docker, where 8390 was the althing post office, so no client changed.
-- **Image:** `gitea.phasefinal.com/pfi/albok-service:0.1.13` @ `sha256:bea95617…` since 2026-10-07 1135 (healthy 1136:17,
+- **Image:** `gitea.phasefinal.com/pfi/albok-service:0.1.14` @ `sha256:01b46f64…` since 2026-10-07 1804 (healthy 1804:35,
+  after the 1803 walk). infra-ops deployed it at albok-dev's ask (althing 8524), from a clean archive of vh/albok `7ae0d2a6`
+  (tag albok-service/v0.1.14). This is unit 4.3, with three additions:
+  - `GET .../sidecars`, a batch sidecar listing. Over 5,000 rows or 8 MiB it answers 413.
+  - Byte-less ingest sightings. A sighting whose stored bytes don't verify gets `needs_bytes`.
+  - **A browse view per wing at `<wing>/.browse/`.** It holds relative symlinks to the whole-file objects that carry no
+    sensitivity class, and each wing's `.git/info/exclude` keeps it out of git. Only a reindex renders the view for
+    objects already stored.
+
+  Detector version 2 is in this release: the URL-password rule now needs a dotted host. The first start re-scanned every
+  wing, and **`leaks` went from 8 to 6** (the two shutterchute placeholders cleared; fleet/memory commit `3548715`).
+  `/health` gains `browse_withheld`; 0 is normal, and a non-zero value is a WARN. No config change.
+  ⚠ **`.browse/` is NOT shared with anyone yet.** The contract gates exposure on a demonstration on the chosen share:
+  rename `.browse/` away on the server, then try a fresh open of an unopened child from the client through a cached
+  listing. That open must fail. sshfs `follow_symlinks` works by path; NFS/SMB may keep directory handles. Report a
+  passing surface to albok-dev, who tells the operator. Rollback: `compose.yaml.pre-0.1.14` (0.1.13) is free, because no
+  sidecar shape changed.
+  Prior: 0.1.13 @ `sha256:bea95617…` (2026-10-07 1135 – 1804) (healthy 1136:17,
   between walks). infra-ops deployed it at albok-dev's ask (althing 8413), from a clean archive of vh/albok `70b55ad7`
   (tag albok-service/v0.1.13). Unit 4.2, the **sensitivity gate**: objects classed `adult` / `personal` / `secret` are
   hidden from every reader unless the token asks to `include` them AND holds `class:<building>/<wing>/<class>` (a wing

stacks/albok-service/compose.yaml

@@ -15,7 +15,7 @@
 #   1512 albok-feedback (restricted wing personal/agent-feedback) is default-deny: no viewer gets it.
 services:
   albok-service:
-    image: gitea.phasefinal.com/pfi/albok-service:0.1.13@sha256:bea9561710c3d69ba27aadb6e16c6d8f9daee5d92146b580fb1eb272bf1ddd64
+    image: gitea.phasefinal.com/pfi/albok-service:0.1.14@sha256:01b46f645ffc81d4c024edaa06d18fe9e3ead2d144ac91185b5c0e6b6289c439
     container_name: albok-service
     restart: unless-stopped
     ports: