files: provision-user CLI + anonymous public HTTP serving (#58)

* feat(files): provision-user CLI + anonymous public HTTP serving

Lets external services (the TronBrowser extension store) host files on
files.profullstack.com without the interactive `ssh join@` onboarding.

- `agentbbs provision-user --name <h> --pubkey "<ssh key>"`: registers a member
  from an SSH *public* key (account = handle + key fingerprint). Reuses
  SanitizeUsername (same rules as join@) + EnsureUser; Files/SFTP access is free
  for members, so the account can immediately
  `scp … files@host:/public/extensions/<slug>/`. JSON output; refuses on key/
  handle collision. New auth.FingerprintAuthorizedKey() parses an
  authorized_keys line to the same SHA256 fp as a live session key (tested).
- setup.sh: the files.<host> Caddy site now serves the shared /public area as
  unauthenticated, read-only static files (handle_path /public/*), so .crx/.zip
  download links work for anyone — mapping 1:1 to the SFTP path. Non-/public
  paths still hit the auth'd web file manager.
- docs/files.md updated.

Note: not compiled here — repo go.mod requires go 1.26 and this sandbox has
1.22.2; changes pass gofmt parse/format checks. Reuses existing store/auth APIs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(vet): redundant newline in wish.Println premium-flow messages

`go test ./...` / `go vet ./...` fail on `wish.Println(… "…\n")` — Println
already appends a newline. Pre-existing on main (its CI is red for the same two
lines); surfaced here. Switched both to `wish.Print` with an explicit trailing
"\n\n" so output bytes are unchanged and vet is satisfied.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

internal/auth/auth.go

@@ -204,3 +204,16 @@ func Fingerprint(key ssh.PublicKey) string {
 	}
 	return gossh.FingerprintSHA256(key)
 }
+
+// FingerprintAuthorizedKey parses an OpenSSH authorized_keys line (e.g.
+// "ssh-ed25519 AAAA… comment") and returns its SHA256 fingerprint — the same
+// value Fingerprint produces for a live session key. Used to provision a member
+// from a public key supplied out of band (e.g. the extension store). Any
+// trailing options/comment are ignored.
+func FingerprintAuthorizedKey(authorizedKey string) (string, error) {
+	key, _, _, _, err := gossh.ParseAuthorizedKey([]byte(strings.TrimSpace(authorizedKey)))
+	if err != nil {
+		return "", err
+	}
+	return gossh.FingerprintSHA256(key), nil
+}