Harden archive bot for production; exempt container egress in edge firewall

- archive_sync_state keyed by room per migration 029 (drop synthetic id cursor)
- putStaging buffers the stream and sends content-length (oCIS rejects chunked)
- mimeClass passthrough from sniffed payload
- edge-firewall: RETURN docker-bridge ingress before the CF-range catch-all so
  container egress (Matrix/R2/platform) survives the 80/443 source filter
- files scaffold: keep the ocdav data-gateway hop on-loopback

infra/occupymedia/edge/edge-firewall.sh

@@ -15,6 +15,14 @@ CF6_URL="https://www.cloudflare.com/ips-v6"
 iptables -F DOCKER-USER
 ip6tables -F DOCKER-USER 2>/dev/null || true
 
+# DOCKER-USER sees forwarded traffic in BOTH directions. Exempt everything
+# originating from a docker bridge (container egress) BEFORE any port rules —
+# otherwise the CF-range catch-all below also drops containers' outbound 443
+# (Matrix/R2/platform calls). Inbound filtering by source is unaffected.
+for br in $(ls /sys/class/net/ | grep -E '^(br-|docker0)'); do
+  iptables -I DOCKER-USER 1 -i "$br" -j RETURN
+done
+
 if [[ $MODE == OPEN ]]; then
   echo "edge firewall: OPEN (any source allowed on 80/443; nginx SNI gate applies)"
   exit 0

infra/occupymedia/files/compose.yml

@@ -20,6 +20,9 @@ services:
       HOME: /var/lib/ocis
       OCIS_CONFIG_DIR: /etc/ocis
       OCIS_URL: ${FILES_PUBLIC_URL:?}
+      # The gateway advertises OCIS_URL/data as the upload endpoint to ocdav;
+      # keep that hop on-loopback so writes survive public-edge outages.
+      GATEWAY_FRONTEND_PUBLIC_URL: http://localhost:9200
       OCIS_INSECURE: "false"
       OCIS_JWT_SECRET: ${OCIS_JWT_SECRET:?}
       IDM_ADMIN_PASSWORD: ${OCIS_ADMIN_PASSWORD:?}