Harden archive bot for production; exempt container egress in edge firewall

- archive_sync_state keyed by room per migration 029 (drop synthetic id cursor)
- putStaging buffers the stream and sends content-length (oCIS rejects chunked)
- mimeClass passthrough from sniffed payload
- edge-firewall: RETURN docker-bridge ingress before the CF-range catch-all so
  container egress (Matrix/R2/platform) survives the 80/443 source filter
- files scaffold: keep the ocdav data-gateway hop on-loopback

infra/occupymedia/files/compose.yml

@@ -20,6 +20,9 @@ services:
       HOME: /var/lib/ocis
       OCIS_CONFIG_DIR: /etc/ocis
       OCIS_URL: ${FILES_PUBLIC_URL:?}
+      # The gateway advertises OCIS_URL/data as the upload endpoint to ocdav;
+      # keep that hop on-loopback so writes survive public-edge outages.
+      GATEWAY_FRONTEND_PUBLIC_URL: http://localhost:9200
       OCIS_INSECURE: "false"
       OCIS_JWT_SECRET: ${OCIS_JWT_SECRET:?}
       IDM_ADMIN_PASSWORD: ${OCIS_ADMIN_PASSWORD:?}