Merge claude/1

WebUI-driven commands (`setup finalize`, `backup`, restore) ran with an
empty $docker_install_user because cliInitialize only called
checkInstallTypeRequirement for the `app` category. The backup engine then
ran `sudo -E -u "" restic init`, which sudo rejects with a usage dump —
surfacing as "Failed to initialize Local disk" in the setup wizard.

Factor the user resolution out of checkInstallTypeRequirement into a
side-effect-free resolveDockerInstallUser (rooted -> sudo_user_name,
rootless -> CFG_DOCKER_INSTALL_USER, with fallbacks so it is never empty)
and call it at the cliInitialize chokepoint so all command categories get a
valid install user, not just app.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Signed-off-by: librelad <librelad@digitalangels.vip>

scripts/checks/requirements/check_install_type.sh

@@ -1,20 +1,35 @@
 #!/bin/bash
 
+# Resolves the system user that owns the Docker install — and therefore the
+# backup repos and container files. Rooted installs run as $sudo_user_name;
+# rootless installs use $CFG_DOCKER_INSTALL_USER. Falls back to $sudo_user_name
+# and finally 'libreportal' so the value is never empty: an empty user turns
+# `sudo -u "$docker_install_user"` into a sudo usage error. Reads only config,
+# so it is safe to call from any CLI entry point.
+resolveDockerInstallUser()
+{
+	if [[ "$CFG_DOCKER_INSTALL_TYPE" == "rootless" ]]; then
+		docker_install_user="$CFG_DOCKER_INSTALL_USER"
+	else
+		docker_install_user="$sudo_user_name"
+	fi
+	[[ -z "$docker_install_user" ]] && docker_install_user="$sudo_user_name"
+	[[ -z "$docker_install_user" ]] && docker_install_user="libreportal"
+}
+
 checkInstallTypeRequirement()
-{  
+{
 	if [[ "$OS_TYPE" == "Ubuntu" || "$OS_TYPE" == "Debian" ]]; then
 		ISCOMP=$( (docker compose -v ) 2>&1 )
 		ISUFW=$( (sudo ufw status ) 2>&1 )
 		ISUFWD=$( (sudo ufw-docker) 2>&1 )
 
+		resolveDockerInstallUser
+
 		if [[ $CFG_DOCKER_INSTALL_TYPE == "rooted" ]]; then
-			# Docker Type username
-        	docker_install_user="$sudo_user_name"
 			# Used for checking if rooted docket is active
 			ISACT=$( (sudo systemctl is-active docker ) 2>&1 )
 		elif [[ $CFG_DOCKER_INSTALL_TYPE == "rootless" ]]; then
-			# Docker Type username
-		    docker_install_user="$CFG_DOCKER_INSTALL_USER"
 			# Used for checking the rootless user
 			local ISUSER=$( (sudo id -u "$CFG_DOCKER_INSTALL_USER"))
 			if [[ "$ISUSER" == *"no such user"* ]]; then
@@ -22,4 +37,4 @@ checkInstallTypeRequirement()
 			fi
 		fi
 	fi
-} 
+}

scripts/cli/cli_initialize.sh

@@ -1,9 +1,16 @@
 #!/bin/bash
 
-cliInitialize() 
+cliInitialize()
 {
     cliUpdateCommands;
 
+    # Many commands shell out via `sudo -u "$docker_install_user"` (backup
+    # engines, permission fixes, file copies). Resolve it up front so commands
+    # run from the WebUI — e.g. `setup finalize`, `backup` — get a valid user
+    # instead of an empty one. The app category still runs the fuller
+    # checkInstallTypeRequirement below.
+    resolveDockerInstallUser;
+
     # Dynamic routing - auto-discover ALL categories!
     local category="$initial_command1"