Track the files scaffold; sync deployed oCIS compose requirements

infra/occupymedia/files/ was gitignored in phase one ('nothing deployed');
the oCIS deployment is now live, and the storage doc + DEPLOY.md link to its
runbook. Track the secret-free scaffold (compose.yml, csp.yaml, README,
tuwunel example, .env.example); keep only .env + secrets/ ignored.

compose.yml carries the deployment-proven fixes: ocis runs as user 1000 with
OCIS_CONFIG_DIR=/etc/ocis and HOME=/var/lib/ocis (source-built images do not
inherit the official image's conventions), and 9200/9980 publish on the LAN
for the CT150 tunnel connector.

infra/occupymedia/files/csp.yaml

@@ -0,0 +1,14 @@
+# Minimal ownCloud Web CSP with the office frame origin; oCIS expands ${VAR}.
+directives:
+  default-src: ["'none'"]
+  child-src: ["'self'"]
+  connect-src: ["'self'", "blob:"]
+  font-src: ["'self'", "data:"]
+  frame-ancestors: ["'self'"]
+  frame-src: ["'self'", "blob:", "https://${OFFICE_HOST}"]
+  img-src: ["'self'", "data:", "blob:", "https://${OFFICE_HOST}"]
+  manifest-src: ["'self'"]
+  media-src: ["'self'"]
+  object-src: ["'self'", "blob:"]
+  script-src: ["'self'", "'unsafe-inline'"]
+  style-src: ["'self'", "'unsafe-inline'"]