Track the files scaffold; sync deployed oCIS compose requirements

infra/occupymedia/files/ was gitignored in phase one ('nothing deployed');
the oCIS deployment is now live, and the storage doc + DEPLOY.md link to its
runbook. Track the secret-free scaffold (compose.yml, csp.yaml, README,
tuwunel example, .env.example); keep only .env + secrets/ ignored.

compose.yml carries the deployment-proven fixes: ocis runs as user 1000 with
OCIS_CONFIG_DIR=/etc/ocis and HOME=/var/lib/ocis (source-built images do not
inherit the official image's conventions), and 9200/9980 publish on the LAN
for the CT150 tunnel connector.

infra/occupymedia/files/tuwunel-r2.toml.example

@@ -0,0 +1,18 @@
+# FUTURE config fragment for an isolated Tuwunel rehearsal, not conduwuit v0.5.0.
+# Do not mount this in occ-chat or substitute images/volumes during phase one.
+# Merge into the selected release's full config privately; TOML does NOT expand env.
+# This represents the fresh R2-only target, not a migration strategy.
+[global]
+media_storage_providers = ["r2"]
+store_media_on_providers = ["r2"]
+media_allow_redirect = true
+error_on_unknown_config_opts = true
+
+[global.storage_provider.r2.s3]
+bucket = "occupymedia-matrix-media"
+region = "auto"
+use_vhost_request = false
+startup_check = true
+# Privately supply endpoint, key, secret with the selected version's secret mechanism.
+# Endpoint: https://<account-id>.r2.cloudflarestorage.com
+# Never reuse the oCIS/AnarchoPoster/PeerTube bucket or key.