feat: in-app Chat (Matrix JWT SSO) + Drive (embedded oCIS)

- api: matrix-sso module (tuwunel jwt -> login/get_token), POST /matrix/session, GET /matrix/identity, drive controller
- web: /chat full-height Element view, /files Library+Drive tabs, embedded-app frame component
- edge: /hub-sso.html handshake route (origin-pinned CSP), X-Frame-Options strip on files
- oCIS: csp.yaml frame-ancestors app.occupymedia.cc
- server config still required: tuwunel [global.jwt], MATRIX_SSO_JWT_SECRET, oCIS restart

infra/occupymedia/files/csp.yaml

@@ -4,7 +4,8 @@ directives:
   child-src: ["'self'"]
   connect-src: ["'self'", "blob:"]
   font-src: ["'self'", "data:"]
-  frame-ancestors: ["'self'"]
+  # The Hub's in-app Drive view (app.occupymedia.cc/files/drive) frames oCIS web.
+  frame-ancestors: ["'self'", "https://app.occupymedia.cc"]
   frame-src: ["'self'", "blob:", "https://${OFFICE_HOST}"]
   img-src: ["'self'", "data:", "blob:", "https://${OFFICE_HOST}"]
   manifest-src: ["'self'"]