feat(files): move filestash to upload., serve files. as read-only static browse

Filestash cannot be served under a subpath (its SPA hardcodes /api, /assets,
/login at root), so it moves to its own subdomain upload.${BASE_DOMAIN}. The
apex-level ask was a static, no-auth file browser at files.${BASE_DOMAIN}: caddy
now file_server browse's the same ${FILES_DATA_DIR} share read-only there.

- filestash general.host -> upload.; nginx upload. vhost keeps the 2g body +
  upload streaming + /admin throttle; new files. vhost is a plain static proxy.
- caddy: 60-files.caddy split into 60-upload.caddy (filestash) + 62-files.caddy
  (file_server browse of /srv/files); caddy mounts FILES_DATA_DIR :ro.
- LE_SUBDOMAINS += upload (both upload. and files. are vhosts needing certs).

Security: files. is unconditionally public read (no auth), independent of
FILES_AUTH. The htpasswd login only gates writes via upload. Documented.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

nginx/ulicraft-caddy.conf.tmpl

@@ -27,14 +27,14 @@ upstream ulicraft_caddy {
 }
 
 # Brute-force throttle for the publicly-exposed Filestash /admin console (it is
-# the only credential on files.), applied in its location block below.
+# the only credential on upload.), applied in its location block below.
 limit_req_zone $binary_remote_addr zone=files_admin:10m rate=6r/m;
 
 # HTTP -> HTTPS for every name.
 server {
     listen 80;
     listen [::]:80;
-    server_name ${BASE_DOMAIN} www.${BASE_DOMAIN} auth.${BASE_DOMAIN} distribution.${BASE_DOMAIN} avatar.${BASE_DOMAIN} status.${BASE_DOMAIN} files.${BASE_DOMAIN} generators.${BASE_DOMAIN};
+    server_name ${BASE_DOMAIN} www.${BASE_DOMAIN} auth.${BASE_DOMAIN} distribution.${BASE_DOMAIN} avatar.${BASE_DOMAIN} status.${BASE_DOMAIN} upload.${BASE_DOMAIN} files.${BASE_DOMAIN} generators.${BASE_DOMAIN};
     return 301 https://$host$request_uri;
 }
 
@@ -152,17 +152,18 @@ server {
     }
 }
 
-# Filestash player file share. Uploads need a real body limit (nginx defaults to
-# 1m, which rejects almost anything worth sharing) and streaming rather than
-# spooling — a 2g upload buffered to disk would write it twice on a host whose
-# disk is already the shared failure domain for Minecraft + Drasl + backups.
+# Filestash player file share (upload.). Uploads need a real body limit (nginx
+# defaults to 1m, which rejects almost anything worth sharing) and streaming
+# rather than spooling — a 2g upload buffered to disk would write it twice on a
+# host whose disk is already the shared failure domain for Minecraft + Drasl +
+# backups.
 server {
     listen 443 ssl http2;
     listen [::]:443 ssl http2;
-    server_name files.${BASE_DOMAIN};
+    server_name upload.${BASE_DOMAIN};
 
-    ssl_certificate     ${APP_DIR}/certs/files.${BASE_DOMAIN}/cert.pem;
-    ssl_certificate_key ${APP_DIR}/certs/files.${BASE_DOMAIN}/key.pem;
+    ssl_certificate     ${APP_DIR}/certs/upload.${BASE_DOMAIN}/cert.pem;
+    ssl_certificate_key ${APP_DIR}/certs/upload.${BASE_DOMAIN}/key.pem;
     add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
 
     client_max_body_size 2g;      # uploads; other vhosts stay at 4m
@@ -190,6 +191,26 @@ server {
     }
 }
 
+# Read-only static browse of the same share (files.) — caddy serves the dir
+# listing, no auth. Read-only, so no upload tuning: standard 4m body is fine.
+server {
+    listen 443 ssl http2;
+    listen [::]:443 ssl http2;
+    server_name files.${BASE_DOMAIN};
+
+    ssl_certificate     ${APP_DIR}/certs/files.${BASE_DOMAIN}/cert.pem;
+    ssl_certificate_key ${APP_DIR}/certs/files.${BASE_DOMAIN}/key.pem;
+    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
+
+    location / {
+        proxy_pass http://ulicraft_caddy;
+        proxy_set_header Host              $host;
+        proxy_set_header X-Real-IP         $remote_addr;
+        proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+    }
+}
+
 server {
     listen 443 ssl http2;
     listen [::]:443 ssl http2;