Harden archive bot for production; exempt container egress in edge firewall

- archive_sync_state keyed by room per migration 029 (drop synthetic id cursor)
- putStaging buffers the stream and sends content-length (oCIS rejects chunked)
- mimeClass passthrough from sniffed payload
- edge-firewall: RETURN docker-bridge ingress before the CF-range catch-all so
  container egress (Matrix/R2/platform) survives the 80/443 source filter
- files scaffold: keep the ocdav data-gateway hop on-loopback

apps/archive-bot/src/archiver.ts

@@ -76,6 +76,7 @@ export class Archiver {
         origin: { kind: "matrix", mxcUri: candidate.mxcUri },
         name: safeName,
         mimeType: payload.sniffed.mime,
+        mimeClass: payload.sniffed.mimeClass,
         sizeBytes: payload.byteSize,
         checksum: { algorithm: "sha256", value: payload.sha256 },
         createdAt: createdAt.toISOString(),