files: provision-user CLI + anonymous public HTTP serving (#58)

* feat(files): provision-user CLI + anonymous public HTTP serving

Lets external services (the TronBrowser extension store) host files on
files.profullstack.com without the interactive `ssh join@` onboarding.

- `agentbbs provision-user --name <h> --pubkey "<ssh key>"`: registers a member
  from an SSH *public* key (account = handle + key fingerprint). Reuses
  SanitizeUsername (same rules as join@) + EnsureUser; Files/SFTP access is free
  for members, so the account can immediately
  `scp … files@host:/public/extensions/<slug>/`. JSON output; refuses on key/
  handle collision. New auth.FingerprintAuthorizedKey() parses an
  authorized_keys line to the same SHA256 fp as a live session key (tested).
- setup.sh: the files.<host> Caddy site now serves the shared /public area as
  unauthenticated, read-only static files (handle_path /public/*), so .crx/.zip
  download links work for anyone — mapping 1:1 to the SFTP path. Non-/public
  paths still hit the auth'd web file manager.
- docs/files.md updated.

Note: not compiled here — repo go.mod requires go 1.26 and this sandbox has
1.22.2; changes pass gofmt parse/format checks. Reuses existing store/auth APIs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(vet): redundant newline in wish.Println premium-flow messages

`go test ./...` / `go vet ./...` fail on `wish.Println(… "…\n")` — Println
already appends a newline. Pre-existing on main (its CI is red for the same two
lines); surfaced here. Switched both to `wish.Print` with an explicit trailing
"\n\n" so output bytes are unchanged and vet is satisfied.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

setup.sh

@@ -699,6 +699,20 @@ fi
 FILES_SITE="
 ${FILES_DOMAIN} {
 	encode zstd gzip
+
+	# Public file area — unauthenticated, read-only HTTP for the shared /public
+	# directory, so download links (e.g. extension .crx/.zip) work for everyone.
+	# Maps 1:1 to the SFTP path: a member who runs
+	#   scp dist.crx files@${FILES_DOMAIN}:/public/extensions/acme/
+	# gets the URL https://${FILES_DOMAIN}/public/extensions/acme/dist.crx .
+	# Everything else falls through to the auth'd web file manager below.
+	handle_path /public/* {
+		root * ${DATA_DIR}/files/public
+		header Cache-Control \"public, max-age=300\"
+		file_server
+	}
+
+	# Member web file manager (webmail-password login; /me + /public browsing).
 	reverse_proxy http://${FILES_WEB_ADDR}
 }
 "