feat(files): move filestash to upload., serve files. as read-only static browse

Filestash cannot be served under a subpath (its SPA hardcodes /api, /assets,
/login at root), so it moves to its own subdomain upload.${BASE_DOMAIN}. The
apex-level ask was a static, no-auth file browser at files.${BASE_DOMAIN}: caddy
now file_server browse's the same ${FILES_DATA_DIR} share read-only there.

- filestash general.host -> upload.; nginx upload. vhost keeps the 2g body +
  upload streaming + /admin throttle; new files. vhost is a plain static proxy.
- caddy: 60-files.caddy split into 60-upload.caddy (filestash) + 62-files.caddy
  (file_server browse of /srv/files); caddy mounts FILES_DATA_DIR :ro.
- LE_SUBDOMAINS += upload (both upload. and files. are vhosts needing certs).

Security: files. is unconditionally public read (no auth), independent of
FILES_AUTH. The htpasswd login only gates writes via upload. Documented.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tooling/render-config.sh

@@ -29,15 +29,15 @@ render() {  # $1=template  $2=output
 render drasl/config/config.toml.tmpl drasl/config/config.toml
 render nmsr/config.toml.tmpl          nmsr/config.toml
 
-# ── filestash (files.${BASE_DOMAIN}) ────────────────────────────────────
+# ── filestash (upload.${BASE_DOMAIN}) ───────────────────────────────────
 # Filestash has NO env-var config: config.json is the source of truth and the
 # admin console writes it back at runtime. We render it and mount it read-only,
 # so git stays authoritative (the console renders but cannot save — by design).
 #
-# general.host in the template is a BARE HOSTNAME (files.$BASE_DOMAIN, no
+# general.host in the template is a BARE HOSTNAME (upload.$BASE_DOMAIN, no
 # scheme) and general.force_ssl is true. The SPA builds its redirect origin as
 # (force_ssl ? "https://" : "http://") + host, so a scheme in `host` produces
-# "http://https://files..." and every client-side redirect breaks. The
+# "http://https://upload..." and every client-side redirect breaks. The
 # server-side Host check strips the scheme first, so curl/monitors see a healthy
 # 200 and ONLY browsers fail. Don't "fix" it by putting the URL back.
 #
@@ -72,7 +72,7 @@ case "$FILES_AUTH" in
     # NO LOGIN — anyone who reaches the vhost gets in. Only safe once this host
     # is NOT reachable from the internet (see plan/20-files.md).
     echo "!! FILES_AUTH=$FILES_AUTH — filestash will have NO authentication." >&2
-    echo "!! Only valid if files.${BASE_DOMAIN} is unreachable from the internet." >&2
+    echo "!! Only valid if upload.${BASE_DOMAIN} is unreachable from the internet." >&2
     FILES_IDP_TYPE="passthrough"
     FILES_IDP_PARAMS="{\\\"type\\\":\\\"passthrough\\\",\\\"strategy\\\":\\\"direct\\\"}"
     ;;