feat(files): move filestash to upload., serve files. as read-only static browse

Filestash cannot be served under a subpath (its SPA hardcodes /api, /assets,
/login at root), so it moves to its own subdomain upload.${BASE_DOMAIN}. The
apex-level ask was a static, no-auth file browser at files.${BASE_DOMAIN}: caddy
now file_server browse's the same ${FILES_DATA_DIR} share read-only there.

- filestash general.host -> upload.; nginx upload. vhost keeps the 2g body +
  upload streaming + /admin throttle; new files. vhost is a plain static proxy.
- caddy: 60-files.caddy split into 60-upload.caddy (filestash) + 62-files.caddy
  (file_server browse of /srv/files); caddy mounts FILES_DATA_DIR :ro.
- LE_SUBDOMAINS += upload (both upload. and files. are vhosts needing certs).

Security: files. is unconditionally public read (no auth), independent of
FILES_AUTH. The htpasswd login only gates writes via upload. Documented.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

CLAUDE.md

@@ -34,7 +34,8 @@ Internet ── host nginx (TLS, LE certs, HSTS) ──► caddy (127.0.0.1:8880
    auth.${BASE_DOMAIN}   ─► drasl        (Yggdrasil API + web UI)
    avatar.${BASE_DOMAIN} ─► nmsr         (skin/avatar renderer, Drasl-backed)
    status.${BASE_DOMAIN} ─► uptime-kuma  (status page + monitors)
-   files.${BASE_DOMAIN}  ─► filestash    (player file share, ONE shared login, writable)
+   upload.${BASE_DOMAIN} ─► filestash    (player file share, ONE shared login, writable)
+   files.${BASE_DOMAIN}  ─► caddy        (read-only, no-auth browse of the same share dir)
    distribution.${BASE}  ─► static site from ANOTHER repo (DISTRIBUTION_WEB_ROOT)
 
 minecraft :25565 (+ 24454/udp Simple Voice Chat)
@@ -108,11 +109,15 @@ automatically; cosmetic-client mods that declare `BOTH` stay `both` until you
 hand-edit `mods-sides.json` to `client`. No Modrinth/packwiz, no network at
 classify/sync time. See `plan/04-mods.md`.
 
-### Filestash (files.) — four traps
+### Filestash (upload.) — four traps
+Filestash serves at `upload.${BASE_DOMAIN}` (can't live under a subpath — SPA
+hardcodes `/api`, `/assets`, `/login` at root). `files.${BASE_DOMAIN}` is a
+separate caddy `file_server browse` of the same `FILES_DATA_DIR` — read-only,
+**no auth**, every uploaded file publicly listable.
 Full list in `plan/20-files.md`; the ones that cost real time:
-- **`general.host` is a BARE HOSTNAME** (`files.${BASE_DOMAIN}`, no scheme) +
+- **`general.host` is a BARE HOSTNAME** (`upload.${BASE_DOMAIN}`, no scheme) +
   `force_ssl: true`. The SPA builds its origin as `scheme + host`, so a URL there
-  yields `http://https://files...` and every client-side redirect dies. The
+  yields `http://https://upload...` and every client-side redirect dies. The
   server strips the scheme before its own Host check, so **curl and the uptime
   monitor stay green while every browser is broken**. Cost a debugging round on
   2026-07-14.