feat(files): move filestash to upload., serve files. as read-only static browse

Filestash cannot be served under a subpath (its SPA hardcodes /api, /assets,
/login at root), so it moves to its own subdomain upload.${BASE_DOMAIN}. The
apex-level ask was a static, no-auth file browser at files.${BASE_DOMAIN}: caddy
now file_server browse's the same ${FILES_DATA_DIR} share read-only there.

- filestash general.host -> upload.; nginx upload. vhost keeps the 2g body +
  upload streaming + /admin throttle; new files. vhost is a plain static proxy.
- caddy: 60-files.caddy split into 60-upload.caddy (filestash) + 62-files.caddy
  (file_server browse of /srv/files); caddy mounts FILES_DATA_DIR :ro.
- LE_SUBDOMAINS += upload (both upload. and files. are vhosts needing certs).

Security: files. is unconditionally public read (no auth), independent of
FILES_AUTH. The htpasswd login only gates writes via upload. Documented.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

caddy/conf.d/60-files.caddy

@@ -1,10 +0,0 @@
-# Files — Filestash player file share (filestash service). Shared login,
-# writable. See plan/20-files.md.
-#
-# Filestash blocks any request whose Host header doesn't match its configured
-# `general.host` (https://files.${BASE_DOMAIN}), with "only traffic from X is
-# allowed". The host nginx forwards the original Host, and caddy passes it
-# through untouched — do NOT rewrite it here or every request 403s.
-http://files.{$BASE_DOMAIN} {
-	reverse_proxy filestash:8334
-}

caddy/conf.d/60-upload.caddy

@@ -0,0 +1,14 @@
+# Upload — Filestash player file share (filestash service). Shared login,
+# writable. See plan/20-files.md.
+#
+# Filestash blocks any request whose Host header doesn't match its configured
+# `general.host` (https://upload.${BASE_DOMAIN}), with "only traffic from X is
+# allowed". The host nginx forwards the original Host, and caddy passes it
+# through untouched — do NOT rewrite it here or every request 403s.
+#
+# Filestash CANNOT be served under a subpath (SPA hardcodes /api, /assets, /login
+# at root), so it gets its own subdomain. The read-only browse of the same share
+# lives at files.${BASE_DOMAIN} (62-files.caddy).
+http://upload.{$BASE_DOMAIN} {
+	reverse_proxy filestash:8334
+}

caddy/conf.d/62-files.caddy

@@ -0,0 +1,8 @@
+# Files — read-only static browse of the shared upload dir (FILES_DATA_DIR,
+# mounted at /srv/files). NO AUTH: every uploaded file is publicly listable and
+# downloadable here. Writes happen through filestash at upload.${BASE_DOMAIN}
+# (60-upload.caddy); this vhost is browse-only.
+http://files.{$BASE_DOMAIN} {
+	root * /srv/files
+	file_server browse
+}