feat(files): SFTP member storage — private workspaces + shared public area + mgmt TUI

Implements M4 (Files). A fully virtual Go SFTP server (pkg/sftp + crypto/ssh,
no OS users) wired as an "sftp" subsystem on the existing :22 wish listener, so
members reach their files with their login key:

    sftp files@bbs.profullstack.com     # scp/rsync ride the same endpoint

Identity is the SSH key (the username is conventional/ignored). Two areas per
session: a private, quota-limited /me workspace and a single shared public file
area /public (old-school BBS file area; world-read, members-only write by
default, operator-moderated). This reverses the old NG1 "no sharing" boundary in
favour of one sanctioned, inspectable sharing surface (PRD §9.3 amended).

internal/files:
- backend.go  service, layout, quota/usage, live-session registry, operator API
- fs.go       per-session virtual FS; resolve() is the single security
              chokepoint (area confinement + symlink-escape guard) + pkg/sftp
              request handlers
- server.go   subsystem handler: key auth -> member session -> request server,
              with byte metering and force-disconnect
- tui.go      in-BBS member browser (hub plugin "Files")
- admin.go    operator management TUI: sessions, workspaces/quotas, public area

Operator console: ssh sftp@<host> (allowlist-gated; sftpadmin@/filesadmin@
aliases) — list/disconnect sessions, set per-user quotas, revoke SFTP access,
toggle public write, moderate the public area.

store: files_access (per-user quota override + revoked) and files_settings
(public-write mode) tables + methods. main.go wiring guarded by AGENTBBS_FILES
(+ AGENTBBS_FILES_QUOTA_MB, default 1 GiB). Route names reserved.

Tests (incl -race): path traversal/confinement, symlink-escape rejection,
public-write ACL, quota enforcement, usage accounting, and an end-to-end run
against a real SFTP client. Docs: docs/files.md; PRD §5.3/§5.3.1/§9.3 + README
updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

internal/store/store.go

@@ -182,6 +182,23 @@ type Store interface {
 	// per-group number, and returns the stored row (with its number).
 	InsertNewsArticle(a NewsArticle) (NewsArticle, error)
 
+	// Files (SFTP) — per-user workspaces + the shared public area (docs/files.md).
+
+	// FilesAccess returns a user's SFTP access record (per-user quota override
+	// and revoked flag). A user with no row reports the zero value
+	// (QuotaBytes 0 = use the server default, Revoked false).
+	FilesAccess(userID int64) (FilesAccess, error)
+	// SetFilesQuota sets a per-user quota override in bytes (0 clears the
+	// override, falling back to the server default). Idempotent upsert.
+	SetFilesQuota(userID, bytes int64) error
+	// SetFilesRevoked revokes (or restores) a user's SFTP access without
+	// touching their BBS login. Idempotent upsert.
+	SetFilesRevoked(userID int64, revoked bool) error
+	// FilesSetting reads a Files service setting (e.g. the public-write mode).
+	FilesSetting(key string) (string, bool, error)
+	// SetFilesSetting writes a Files service setting. Idempotent upsert.
+	SetFilesSetting(key, value string) error
+
 	Close() error
 }
 
@@ -213,6 +230,14 @@ type NewsArticle struct {
 	CreatedAt time.Time
 }
 
+// FilesAccess is a user's SFTP access record. QuotaBytes is a per-user override
+// (0 means "use the server default"); Revoked blocks SFTP without affecting the
+// BBS login.
+type FilesAccess struct {
+	QuotaBytes int64
+	Revoked    bool
+}
+
 // RatingRow is one ladder entry.
 type RatingRow struct {
 	User   string
@@ -471,6 +496,16 @@ CREATE TABLE IF NOT EXISTS news_articles (
 );
 CREATE INDEX IF NOT EXISTS idx_news_articles_grp ON news_articles(grp, num);
 CREATE INDEX IF NOT EXISTS idx_news_articles_msgid ON news_articles(msg_id);
+CREATE TABLE IF NOT EXISTS files_access (
+  user_id INTEGER PRIMARY KEY,
+  quota_bytes INTEGER NOT NULL DEFAULT 0,
+  revoked INTEGER NOT NULL DEFAULT 0,
+  updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+);
+CREATE TABLE IF NOT EXISTS files_settings (
+  key TEXT PRIMARY KEY,
+  value TEXT NOT NULL DEFAULT ''
+);
 `
 
 func (s *sqliteStore) EnsureUser(name, kind, fp string) (User, error) {
@@ -929,4 +964,65 @@ func (s *sqliteStore) RecordQryptInvite(username, jti string, quota int) error {
 	return tx.Commit()
 }
 
+// --- Files (SFTP) ------------------------------------------------------------
+
+func (s *sqliteStore) FilesAccess(userID int64) (FilesAccess, error) {
+	var fa FilesAccess
+	var revoked int
+	err := s.db.QueryRow(
+		`SELECT quota_bytes, revoked FROM files_access WHERE user_id = ?`, userID,
+	).Scan(&fa.QuotaBytes, &revoked)
+	if errors.Is(err, sql.ErrNoRows) {
+		return FilesAccess{}, nil
+	}
+	if err != nil {
+		return FilesAccess{}, err
+	}
+	fa.Revoked = revoked != 0
+	return fa, nil
+}
+
+func (s *sqliteStore) SetFilesQuota(userID, bytes int64) error {
+	_, err := s.db.Exec(`
+		INSERT INTO files_access (user_id, quota_bytes, updated_at)
+		VALUES (?, ?, strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+		ON CONFLICT(user_id) DO UPDATE SET
+		  quota_bytes = excluded.quota_bytes,
+		  updated_at  = excluded.updated_at`, userID, bytes)
+	return err
+}
+
+func (s *sqliteStore) SetFilesRevoked(userID int64, revoked bool) error {
+	r := 0
+	if revoked {
+		r = 1
+	}
+	_, err := s.db.Exec(`
+		INSERT INTO files_access (user_id, revoked, updated_at)
+		VALUES (?, ?, strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+		ON CONFLICT(user_id) DO UPDATE SET
+		  revoked    = excluded.revoked,
+		  updated_at = excluded.updated_at`, userID, r)
+	return err
+}
+
+func (s *sqliteStore) FilesSetting(key string) (string, bool, error) {
+	var v string
+	err := s.db.QueryRow(`SELECT value FROM files_settings WHERE key = ?`, key).Scan(&v)
+	if errors.Is(err, sql.ErrNoRows) {
+		return "", false, nil
+	}
+	if err != nil {
+		return "", false, err
+	}
+	return v, true, nil
+}
+
+func (s *sqliteStore) SetFilesSetting(key, value string) error {
+	_, err := s.db.Exec(`
+		INSERT INTO files_settings (key, value) VALUES (?, ?)
+		ON CONFLICT(key) DO UPDATE SET value = excluded.value`, key, value)
+	return err
+}
+
 func (s *sqliteStore) Close() error { return s.db.Close() }