feat(files): gate files. browse behind FILES_BROWSE (on|off)

Per-host toggle for the read-only, no-auth browse of the shared upload dir,
so it can stay on for the LAN-party host (oxps) and be off on the
internet-facing one (cochi). Defaults to `on` — existing hosts unchanged.

Neither layer has conditionals, so each gets the value substituted in:
- caddy: docker-compose mounts 62-files.${FILES_BROWSE:-on}.caddy at the
  fixed conf.d target (62-files.caddy -> 62-files.on.caddy, plus a
  comments-only 62-files.off.caddy stub — caddy needs a parseable file
  there). Same trick as FILES_MOUNT_MODE.
- nginx: render-nginx.sh splices nginx/files-browse.server.tmpl into
  ${FILES_BROWSE_SERVER} and adds/omits the name in the port-80 redirect.
  This is the gate that matters; caddy is bound to 127.0.0.1.

Applying a change needs render-nginx.sh --install plus a caddy
--force-recreate (single-file bind mount pins the inode). With `off`,
drop `files` from LE_SUBDOMAINS on that host. upload. is unaffected.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -172,7 +172,14 @@ services:
       - ./caddy/conf.d/40-avatar.caddy:/etc/caddy/conf.d/40-avatar.caddy:ro
       - ./caddy/conf.d/50-status.caddy:/etc/caddy/conf.d/50-status.caddy:ro
       - ./caddy/conf.d/60-upload.caddy:/etc/caddy/conf.d/60-upload.caddy:ro
-      - ./caddy/conf.d/62-files.caddy:/etc/caddy/conf.d/62-files.caddy:ro
+      # files.${BASE_DOMAIN} read-only browse, gated by FILES_BROWSE (on|off).
+      # The value is substituted straight into the source path — `on` mounts the
+      # real vhost, `off` a comment-only stub — because compose has no
+      # conditionals (same trick as FILES_MOUNT_MODE). Changing it needs
+      # `docker compose up -d --force-recreate caddy`: a single-file bind mount
+      # pins the inode. The public gate is the nginx vhost (render-nginx.sh
+      # reads the same var); this one keeps caddy itself from serving the share.
+      - ./caddy/conf.d/62-files.${FILES_BROWSE:-on}.caddy:/etc/caddy/conf.d/62-files.caddy:ro
       - ./caddy/conf.d/70-generators.caddy:/etc/caddy/conf.d/70-generators.caddy:ro
       - ./www:/srv/www:ro
       - ./launcher:/srv/launcher:ro