Email members their git + mailbox credentials on provisioning (#57)

* feat(files): SFTP member storage — private workspaces + shared public area + mgmt TUI

Implements M4 (Files). A fully virtual Go SFTP server (pkg/sftp + crypto/ssh,
no OS users) wired as an "sftp" subsystem on the existing :22 wish listener, so
members reach their files with their login key:

    sftp files@bbs.profullstack.com     # scp/rsync ride the same endpoint

Identity is the SSH key (the username is conventional/ignored). Two areas per
session: a private, quota-limited /me workspace and a single shared public file
area /public (old-school BBS file area; world-read, members-only write by
default, operator-moderated). This reverses the old NG1 "no sharing" boundary in
favour of one sanctioned, inspectable sharing surface (PRD §9.3 amended).

internal/files:
- backend.go  service, layout, quota/usage, live-session registry, operator API
- fs.go       per-session virtual FS; resolve() is the single security
              chokepoint (area confinement + symlink-escape guard) + pkg/sftp
              request handlers
- server.go   subsystem handler: key auth -> member session -> request server,
              with byte metering and force-disconnect
- tui.go      in-BBS member browser (hub plugin "Files")
- admin.go    operator management TUI: sessions, workspaces/quotas, public area

Operator console: ssh sftp@<host> (allowlist-gated; sftpadmin@/filesadmin@
aliases) — list/disconnect sessions, set per-user quotas, revoke SFTP access,
toggle public write, moderate the public area.

store: files_access (per-user quota override + revoked) and files_settings
(public-write mode) tables + methods. main.go wiring guarded by AGENTBBS_FILES
(+ AGENTBBS_FILES_QUOTA_MB, default 1 GiB). Route names reserved.

Tests (incl -race): path traversal/confinement, symlink-escape rejection,
public-write ACL, quota enforcement, usage accounting, and an end-to-end run
against a real SFTP client. Docs: docs/files.md; PRD §5.3/§5.3.1/§9.3 + README
updated.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* Add notify-creds subcommand to (re)email members git + mailbox creds

`agentbbs notify-creds` backfills credential emails to verified members
who signed up before the git/mailbox welcome emails existed.

- git (all verified): forgejo.EnsureUserReset resets each account to a
  fresh one-time password (must-change) and emails the web login link,
  username, and password. New method since the original one-time
  password is not recoverable for existing accounts.
- mailbox (all verified): ensures the forwardemail alias and emails the
  address + webmail link.
- Preview by default; --send executes. --git/--mail/--user filters.
  Refuses --send without SMTP; warns+skips when Forgejo/forwardemail
  are unconfigured.

Also folds in the welcome-email functions (gitWelcomeEmailBody,
mailWelcomeEmailBody, EnsureUser password return, provisionGit/
ensurePremium sends) that this builds on. README ops + forgejo tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

README.md

@@ -74,6 +74,15 @@ Ops:
 
 ```bash
 ./agentbbs grant-pod alice 12    # manual pod grant (12 months)
+
+# (re)email verified members their git + mailbox creds/links — preview first,
+# then --send. Git: resets each Forgejo account to a fresh one-time password and
+# emails the web login link; mailbox: ensures the @mail alias and emails the
+# address + webmail link. Needs AGENTBBS_SMTP_*, _FORGEJO_*, _FORWARDEMAIL_* set.
+./agentbbs notify-creds                  # preview, all verified members
+./agentbbs notify-creds --send           # really send git + mailbox to everyone
+./agentbbs notify-creds --git --send     # git creds only
+./agentbbs notify-creds --user alice --mail --send
 ```
 
 ## Deploy