feat(files): gate files. browse behind FILES_BROWSE (on|off)

Per-host toggle for the read-only, no-auth browse of the shared upload dir,
so it can stay on for the LAN-party host (oxps) and be off on the
internet-facing one (cochi). Defaults to `on` — existing hosts unchanged.

Neither layer has conditionals, so each gets the value substituted in:
- caddy: docker-compose mounts 62-files.${FILES_BROWSE:-on}.caddy at the
  fixed conf.d target (62-files.caddy -> 62-files.on.caddy, plus a
  comments-only 62-files.off.caddy stub — caddy needs a parseable file
  there). Same trick as FILES_MOUNT_MODE.
- nginx: render-nginx.sh splices nginx/files-browse.server.tmpl into
  ${FILES_BROWSE_SERVER} and adds/omits the name in the port-80 redirect.
  This is the gate that matters; caddy is bound to 127.0.0.1.

Applying a change needs render-nginx.sh --install plus a caddy
--force-recreate (single-file bind mount pins the inode). With `off`,
drop `files` from LE_SUBDOMAINS on that host. upload. is unaffected.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

caddy/conf.d/62-files.off.caddy

@@ -0,0 +1,9 @@
+# Files browse DISABLED (FILES_BROWSE=off in .env).
+#
+# This stub is mounted at /etc/caddy/conf.d/62-files.caddy instead of
+# 62-files.on.caddy, so caddy defines NO vhost for files.${BASE_DOMAIN} and the
+# share is not served read-only anywhere. Uploads via upload.${BASE_DOMAIN}
+# (filestash) are unaffected — that is a separate service.
+#
+# Caddy needs a parseable file here, not an absent one: the Caddyfile imports
+# conf.d/*.caddy and the mount target is fixed. Comments only, on purpose.