Add opt-in fix for Homebox's missing default entity types (#1593)

Some Homebox collections never get their default Location/Item entity
types seeded (a known upstream bug), leaving the Create dialog's type
dropdown empty and every creation attempt failing with "Please select
an entity type".

_homebox_offer_entity_type_fix() repairs this without ever storing a
credential: entity types are scoped per collection with no
unauthenticated API access, so it prompts for a pasted API token at
the moment it runs (used once, never written to .env or disk, same
model as Immich's own admin-API-key prompt), then seeds the two
default types only if none already exist. Wired into both the
fresh-install and update paths.

services/homebox.sh

@@ -319,6 +319,79 @@ _homebox_offer_disable_local_login() {
         || log_warning "Restart failed — check: docker compose -f $DIR/docker-compose.yml logs"
 }
 
+# Some Homebox installs hit an upstream bug (sysadminsmedia/homebox#1593): a
+# collection's default "Location"/"Item" entity types never get seeded, so
+# the Create dialog's type dropdown comes up empty and every Location/Item
+# creation fails with "Please select an entity type". There's no
+# unauthenticated way to detect or fix this — entity types are scoped per
+# collection (confirmed against Homebox's own swagger doc: GET/POST
+# /v1/entity-types both require a bearer token) — so this is opt-in and
+# asks for a token at the moment it runs, same trust model as Immich's
+# _immich_offer_authelia_oidc(): pasted once, used once, never written to
+# .env or disk.
+#
+# Args: DIR WEB_PORT
+_homebox_offer_entity_type_fix() {
+    local DIR="$1" WEB_PORT="$2"
+    local LOCAL_URL="http://localhost:${WEB_PORT}"
+
+    echo ""
+    local _hit_bug=""
+    prompt_yn "  Hit \"Please select an entity type\" with an empty type list when creating a Location/Item? (y/n):" "n" _hit_bug
+    [[ "$_hit_bug" =~ ^[Yy]$ ]] || return 0
+
+    echo ""
+    log_info "That's a known upstream Homebox bug (sysadminsmedia/homebox#1593) — this"
+    log_info "collection's default entity types were never seeded. Fixing it needs an"
+    log_info "API token from an account that's already registered:"
+    echo "  1. Log into Homebox in your browser (register first if you haven't)."
+    echo "  2. Open your profile menu -> Create API Token."
+    echo "  3. Paste it below — used once right now, never saved to disk."
+    echo ""
+    local HB_TOKEN=""
+    prompt_text "  Homebox API token:" "" HB_TOKEN
+    if [ -z "$HB_TOKEN" ]; then
+        log_info "Skipped. Re-run 'sudo ./setup.sh homebox' (choose update) once you have a token."
+        return 0
+    fi
+
+    local VERIFY_CODE
+    VERIFY_CODE="$(curl -s -o /dev/null -w '%{http_code}' -H "Authorization: Bearer $HB_TOKEN" "$LOCAL_URL/api/v1/users/self" 2>/dev/null)"
+    if [ "$VERIFY_CODE" != "200" ]; then
+        log_warning "Token didn't validate (HTTP $VERIFY_CODE) — skipping. Generate a fresh one and re-run."
+        return 0
+    fi
+
+    local EXISTING_TYPES
+    EXISTING_TYPES="$(curl -s -H "Authorization: Bearer $HB_TOKEN" "$LOCAL_URL/api/v1/entity-types" 2>/dev/null)"
+    if echo "$EXISTING_TYPES" | grep -q '"isLocation":[[:space:]]*true'; then
+        log_success "This collection already has a location-type entity type — nothing to fix."
+        return 0
+    fi
+
+    local _created=0 _code
+    _code="$(curl -s -o /dev/null -w '%{http_code}' -X POST -H "Authorization: Bearer $HB_TOKEN" \
+        -H "Content-Type: application/json" -d '{"name":"Location","isLocation":true}' \
+        "$LOCAL_URL/api/v1/entity-types" 2>/dev/null)"
+    [[ "$_code" == 20* ]] && _created=$((_created + 1))
+    _code="$(curl -s -o /dev/null -w '%{http_code}' -X POST -H "Authorization: Bearer $HB_TOKEN" \
+        -H "Content-Type: application/json" -d '{"name":"Item","isLocation":false}' \
+        "$LOCAL_URL/api/v1/entity-types" 2>/dev/null)"
+    [[ "$_code" == 20* ]] && _created=$((_created + 1))
+
+    if [ "$_created" -eq 2 ]; then
+        log_success "Created the missing 'Location' and 'Item' entity types — the Create dialog's type dropdown should be populated now."
+    else
+        log_warning "Something didn't go through cleanly — check the type dropdown in Homebox and retry if it's still empty."
+    fi
+
+    echo ""
+    log_info "This only fixes the ONE collection your token's account belongs to. Homebox"
+    log_info "has no documented way to switch a token between collections, so if you use"
+    log_info "more than one collection, log in as a member of each other one, generate a"
+    log_info "token there, and re-run this step for it too."
+}
+
 install_homebox() {
     require_docker || return 1
     log_info "Installing Homebox..."
@@ -381,6 +454,14 @@ install_homebox() {
                             || log_warning "Refresh failed — check: docker compose -f $HB_DIR/docker-compose.yml logs"
                         _homebox_offer_authelia_oidc "$HB_DIR" "$CONTAINER"
                         _homebox_offer_disable_local_login "$HB_DIR"
+                        # WEB_PORT isn't persisted anywhere but the compose
+                        # file itself — re-derive it here the same way
+                        # services/immich.sh does for its own update-path
+                        # offer, rather than assuming the pre-scan default.
+                        local _EXISTING_PORT
+                        _EXISTING_PORT="$(grep -oP '^\s+- "?\K[0-9]+(?=:7745)' "$HB_DIR/docker-compose.yml" 2>/dev/null | head -1)"
+                        [ -n "$_EXISTING_PORT" ] && WEB_PORT="$_EXISTING_PORT"
+                        _homebox_offer_entity_type_fix "$HB_DIR" "$WEB_PORT"
                         return 0
                         ;;
                     cancel)
@@ -475,6 +556,7 @@ HB_ENV
     configure_caddy_for_service "Homebox${INSTANCE_SUFFIX:+ ($INSTANCE_SUFFIX)}" "${CONTAINER}:7745" "homebox${INSTANCE_SUFFIX:+-$INSTANCE_SUFFIX}"
 
     _homebox_offer_authelia_oidc "$HB_DIR" "$CONTAINER"
+    _homebox_offer_entity_type_fix "$HB_DIR" "$WEB_PORT"
 
     write_readme "$HB_DIR" << MD
 # Homebox${INSTANCE_SUFFIX:+ — $INSTANCE_SUFFIX}