Add group cloud: files index api, web UI, archive sync bot

The Telegram-like group file contract (packages/core shared-files.ts) becomes
a working subsystem, built in three parallel tracks:

API (NestJS): migration 029 group_files (chat_media_archive metadata-only
index with partial replay-unique + RLS, group_file_shares with sha256 token
persistence, archive_sync_state/outbox durable-claim seam incl. a unique
claim_key index), group-files module (list/search with cursor pagination,
direct upload ≤20 MiB streamed+hashed to oCIS WebDAV, download with ACL +
retention rechecks, share links with expiry, retention modes incl.
legalHold) — RBAC group-membership authz + audit chain events.

Web: Files section per group — group picker, drag-drop upload (20 MiB cap),
search + MIME/origin filters, cursor pagination, download via authenticated
blob fetch, share dialog with expiry + shown-once token, admin retention
dialog; bilingual EN/ES (wiki i18n pattern); nav sidebar/palette/bottom-nav
wiring; MIME classes aligned to the DB CHECK (document/other).

Archive bot (apps/archive-bot): plain sync-loop Matrix bot mirroring
attachments from explicitly-mapped unencrypted archive rooms — raw /sync
with durable since-cursor, outbox-claimed ingestion (hash-verified stream,
no temp files), magic-byte MIME sniffing, safe-name normalization, WebDAV
upload, indexed + replied with link, redaction→unavailable; health endpoint;
Dockerfile. Tests 74/74, typecheck clean across api/web/bot.

apps/archive-bot/Dockerfile

@@ -0,0 +1,17 @@
+# Hub archive sync bot. Build from the monorepo root so workspace:* deps resolve:
+#   docker build -f apps/archive-bot/Dockerfile -t hub-archive-bot .
+FROM node:22-slim AS build
+WORKDIR /app
+COPY . .
+RUN NODE_ENV=development npx --yes pnpm@9.12.0 install --frozen-lockfile
+RUN npx --yes pnpm@9.12.0 --filter @tactical-media-broadcast-hub/archive-bot... build
+
+FROM node:22-slim
+ENV NODE_ENV=production
+WORKDIR /app
+# Workspace node_modules are relative symlinks; copy the built tree whole.
+COPY --from=build --chown=node:node /app /app
+# Non-root, and the bot never writes payloads to disk (streams straight to WebDAV).
+USER node
+EXPOSE 8085
+CMD ["node", "/app/apps/archive-bot/dist/main.js"]