Harden archive bot for production; exempt container egress in edge firewall

- archive_sync_state keyed by room per migration 029 (drop synthetic id cursor)
- putStaging buffers the stream and sends content-length (oCIS rejects chunked)
- mimeClass passthrough from sniffed payload
- edge-firewall: RETURN docker-bridge ingress before the CF-range catch-all so
  container egress (Matrix/R2/platform) survives the 80/443 source filter
- files scaffold: keep the ocdav data-gateway hop on-loopback

infra/occupymedia/edge/edge-firewall.sh

@@ -15,6 +15,14 @@ CF6_URL="https://www.cloudflare.com/ips-v6"
 iptables -F DOCKER-USER
 ip6tables -F DOCKER-USER 2>/dev/null || true
 
+# DOCKER-USER sees forwarded traffic in BOTH directions. Exempt everything
+# originating from a docker bridge (container egress) BEFORE any port rules —
+# otherwise the CF-range catch-all below also drops containers' outbound 443
+# (Matrix/R2/platform calls). Inbound filtering by source is unaffected.
+for br in $(ls /sys/class/net/ | grep -E '^(br-|docker0)'); do
+  iptables -I DOCKER-USER 1 -i "$br" -j RETURN
+done
+
 if [[ $MODE == OPEN ]]; then
   echo "edge firewall: OPEN (any source allowed on 80/443; nginx SNI gate applies)"
   exit 0