feat(template): add File Browser workspace app

[homelab-agent-bot]

What

• add a dedicated Coder agent and owner-only Files application for File Browser Quantum
• run the upstream, digest-pinned image as a sidecar whose PID 1 is the Coder agent and whose startup script launches File Browser
• mount the selected home PVC's workspace subdirectory at /srv
• supply File Browser configuration through the workspace ConfigMap while keeping its generated database on ephemeral storage

Why

File Browser needs to see the same persistent files as the main workspace without becoming a separately exposed Kubernetes service. The Coder agent supplies the transport and authentication boundary, and a subdomain app preserves File Browser's root-relative routing.

The sidecar uses the workspace UID/GID so files created with ordinary owner-only write permissions remain editable from either container. Its own mutable database is intentionally ephemeral; authentication and reachability belong to Coder, while the durable content remains exclusively on the selected home PVC.

Validation

• pre-commit run --all-files
• tofu validate
• tflint --config=../../../.tflint.hcl
• upstream image smoke test as UID/GID 10001 with the mounted configuration and home directory
• independent subagent review, including a permission-boundary correction and clean re-review

Dependency

Stacked on PR #930, which makes the existing readiness check select the primary agent explicitly.

The stacked workflow PR adds runtime coverage for the sidecar, shared storage, and proxied UI.