feat(files): move filestash to upload., serve files. as read-only static browse

Filestash cannot be served under a subpath (its SPA hardcodes /api, /assets,
/login at root), so it moves to its own subdomain upload.${BASE_DOMAIN}. The
apex-level ask was a static, no-auth file browser at files.${BASE_DOMAIN}: caddy
now file_server browse's the same ${FILES_DATA_DIR} share read-only there.

- filestash general.host -> upload.; nginx upload. vhost keeps the 2g body +
  upload streaming + /admin throttle; new files. vhost is a plain static proxy.
- caddy: 60-files.caddy split into 60-upload.caddy (filestash) + 62-files.caddy
  (file_server browse of /srv/files); caddy mounts FILES_DATA_DIR :ro.
- LE_SUBDOMAINS += upload (both upload. and files. are vhosts needing certs).

Security: files. is unconditionally public read (no auth), independent of
FILES_AUTH. The htpasswd login only gates writes via upload. Documented.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -159,10 +159,14 @@ services:
       - ./caddy/conf.d/30-distribution.caddy:/etc/caddy/conf.d/30-distribution.caddy:ro
       - ./caddy/conf.d/40-avatar.caddy:/etc/caddy/conf.d/40-avatar.caddy:ro
       - ./caddy/conf.d/50-status.caddy:/etc/caddy/conf.d/50-status.caddy:ro
-      - ./caddy/conf.d/60-files.caddy:/etc/caddy/conf.d/60-files.caddy:ro
+      - ./caddy/conf.d/60-upload.caddy:/etc/caddy/conf.d/60-upload.caddy:ro
+      - ./caddy/conf.d/62-files.caddy:/etc/caddy/conf.d/62-files.caddy:ro
       - ./caddy/conf.d/70-generators.caddy:/etc/caddy/conf.d/70-generators.caddy:ro
       - ./www:/srv/www:ro
       - ./launcher:/srv/launcher:ro
+      # Read-only browse of the shared upload dir at files.${BASE_DOMAIN}
+      # (62-files.caddy). Same host path filestash writes to via /data/files.
+      - ${FILES_DATA_DIR:?FILES_DATA_DIR unset in .env}:/srv/files:ro
       # Static site from ANOTHER repo (absolute host path in .env).
       - ${DISTRIBUTION_WEB_ROOT:?DISTRIBUTION_WEB_ROOT unset in .env}:/srv/distribution:ro
     networks:
@@ -245,8 +249,9 @@ services:
     networks:
       - mcnet
 
-  # Player file share (screenshots, schematics, maps) at files.${BASE_DOMAIN}.
-  # ONE shared login for everybody (FILES_AUTH=htpasswd), writable. See
+  # Player file share (screenshots, schematics, maps) at upload.${BASE_DOMAIN}.
+  # ONE shared login for everybody (FILES_AUTH=htpasswd), writable. The same
+  # share is browsable read-only + no-auth at files.${BASE_DOMAIN} (via caddy). See
   # plan/20-files.md — it documents every non-obvious bit of this service.
   #
   # Config is rendered read-only from filestash/config.json.tmpl: filestash has