docs(files): spell out access policy — members-only, free for all (not Premium-gated)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

docs/PRD.md

@@ -210,6 +210,10 @@ directly over SFTP with the member's existing SSH login key.
   member reaches their private files with the same key they log in with
   (`sftp files@bbs.profullstack.com`). `scp`/`rsync -e ssh` work over the same
   endpoint.
+- **Eligibility:** members-only, **free for every member** (free and paid alike,
+  like IRC and News — not a Premium-gated perk). Non-members are refused at the
+  handshake; guests don't see the in-BBS browser. Operators can revoke an
+  individual account's SFTP access without affecting its BBS login.
 - **In-BBS view:** a TUI file browser for the user's own workspace and the
   shared area (list, rename, delete, up/download path, view usage vs. quota).
 - **Operator TUI:** an admin management surface for the SFTP server — list

docs/files.md

@@ -17,6 +17,20 @@ The username (`files`) is conventional and ignored — **identity is your SSH
 key** (one key = one account, like the rest of the BBS). `scp`/`rsync` work
 because they tunnel over the same SSH transport.
 
+## Who can use it
+
+**Members only — but free for every member.** Like IRC and News, file storage is
+gated on membership, *not* on the paid Founding Lifetime plan:
+
+- **Non-members can't connect.** A key that isn't a registered account is
+  refused at the SFTP handshake (`this key isn't a member — register first`), and
+  guests don't see the in-hub Files browser.
+- **Every verified member can connect, run, and join** — free and paid alike.
+  There is no Premium gate anywhere in the Files path; the plan only affects
+  unrelated perks (custom email, domains, Tor).
+- Operators can revoke an individual account's SFTP access (abuse response)
+  without touching its BBS login — see the management TUI below.
+
 ## Two areas
 
 When you connect you see a virtual root with two directories: