feat(files): gate files. browse behind FILES_BROWSE (on|off)

Per-host toggle for the read-only, no-auth browse of the shared upload dir,
so it can stay on for the LAN-party host (oxps) and be off on the
internet-facing one (cochi). Defaults to `on` — existing hosts unchanged.

Neither layer has conditionals, so each gets the value substituted in:
- caddy: docker-compose mounts 62-files.${FILES_BROWSE:-on}.caddy at the
  fixed conf.d target (62-files.caddy -> 62-files.on.caddy, plus a
  comments-only 62-files.off.caddy stub — caddy needs a parseable file
  there). Same trick as FILES_MOUNT_MODE.
- nginx: render-nginx.sh splices nginx/files-browse.server.tmpl into
  ${FILES_BROWSE_SERVER} and adds/omits the name in the port-80 redirect.
  This is the gate that matters; caddy is bound to 127.0.0.1.

Applying a change needs render-nginx.sh --install plus a caddy
--force-recreate (single-file bind mount pins the inode). With `off`,
drop `files` from LE_SUBDOMAINS on that host. upload. is unaffected.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

caddy/conf.d/62-files.on.caddy

@@ -0,0 +1,8 @@
+# Files — read-only static browse of the shared upload dir (FILES_DATA_DIR,
+# mounted at /srv/files). NO AUTH: every uploaded file is publicly listable and
+# downloadable here. Writes happen through filestash at upload.${BASE_DOMAIN}
+# (60-upload.caddy); this vhost is browse-only.
+http://files.{$BASE_DOMAIN} {
+	root * /srv/files
+	file_server browse
+}