docs(files): document filestash across plan/README/deploy skill

Fold files./filestash into the docs that carry the service list, the vhost
map and the deploy procedure — README stack table, 00-overview, 02-caddy,
12-build-order, 14-deploy, and the deploy skill.

Two real gaps the filestash deploy exposed, now guardrails in the skill:
- update-all.sh never touches host nginx, so a NEW SUBDOMAIN silently 404s
  after deploy. It needs issue-letsencrypt.sh + render-nginx.sh --install.
- a new service with ${FOO:?} guards fails the WHOLE compose file, so a
  missing .env var means `up` starts nothing — and --hard has already run
  `down`. Check the host's .env BEFORE tearing the stack down.

Also: filestash/config.json is a single-file bind mount re-rendered every
run, so a rolling update-all leaves it on a stale inode (same trap as the
caddy conf) — force-recreate after any FILES_* change.

Correct the cochi divergence section: `git diff HEAD` on the host is now
empty (verified this deploy — the ff-pull succeeded). The documented
docker-compose.yml/package.json divergence was converged; only untracked
dnsmasq/, caddy-root-ca.crt and a stale pack/ remain. The stash-pull-pop
procedure it prescribed is no longer needed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plan/12-build-order.md

@@ -50,6 +50,15 @@ Dependency-ordered. Each numbered item = one git commit. Operational steps
 17. `feat(nginx): add ulicraft-caddy.conf.tmpl + render-nginx.sh`
 18. `feat(tls): add issue-letsencrypt.sh (OVH DNS-01) + LE env block`
 
+## Phase 11 — file share (DONE, 2026-07-14)
+19. `feat(files): add Filestash player file share at files.${BASE_DOMAIN}` —
+    compose service (digest-pinned) + `60-files.caddy` + nginx vhost (2g uploads,
+    `/admin` rate limit) + `filestash/config.json.tmpl` rendered `:ro` +
+    `FILES_*` env block. One shared htpasswd login, writable. See `20-files.md`.
+    - [ops] `files` added to `LE_SUBDOMAINS` → `issue-letsencrypt.sh`, then
+      `render-nginx.sh --install` (a new subdomain needs BOTH; `update-all.sh`
+      does not touch host nginx).
+
 ## Phase 10 — operational (no commits)
 - [ops] Prep online (once): `tooling/render-config.sh`, build landing
   (`cd landing && set -a && . ../.env && set +a && pnpm run build` — sources