feat: cut files.ginnoir.com over to Nextcloud; fix scope PKs

Switch files.ginnoir.com from ownCloud to Nextcloud (internal-only).
Fix Authentik scope PKs in CLAUDE.md — the last UUID segments were
wrong and would have caused provider creation failures.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

CLAUDE.md

@@ -114,9 +114,12 @@ If the service has built-in OAuth2/OIDC login (Immich, Paperless-ngx, Gitea, etc
      "authorization_flow": "b88daebc-c54d-4e85-ae27-8b47384d5d74",
      "invalidation_flow": "3259f9c5-7eab-40bf-81cb-2b0ede6eb7b3",
      "property_mappings": ["718abef2-...", "19491dd8-...", "ca45a8da-..."],
-     "sub_mode": "hashed_user_id"
+     "sub_mode": "hashed_user_id",
+     "grant_types": ["authorization_code", "hybrid", "implicit", "client_credentials", "password", "urn:ietf:params:oauth:grant-type:device_code", "refresh_token"],
+     "signing_key": "dc7cbd9e-c6d2-4168-b402-e7570bcb59d1"
    }
    ```
+   **IMPORTANT:** `grant_types` and `signing_key` must be set explicitly — the API defaults `grant_types` to `[]` (empty = all auth requests rejected as `invalid_request`) and leaves `signing_key` null (tokens can't be signed).
    Note the returned `pk`, `client_id`, and `client_secret`.
 
 2. **Create an Authentik application** → `POST /api/v3/core/applications/`:
@@ -134,9 +137,9 @@ If the service has built-in OAuth2/OIDC login (Immich, Paperless-ngx, Gitea, etc
 |---|---|
 | Implicit consent flow | `b88daebc-c54d-4e85-ae27-8b47384d5d74` |
 | Invalidation flow | `3259f9c5-7eab-40bf-81cb-2b0ede6eb7b3` |
-| Scope — openid | `718abef2-8e8e-4133-afe7-a0eec7b37aba` |
-| Scope — email | `19491dd8-da08-469a-8e5e-3be8ed1cbe5d` |
-| Scope — profile | `ca45a8da-a38f-4ffe-b7a3-f0c0bac2df92` |
+| Scope — openid | `718abef2-504c-452c-9ff0-329eda8031c7` |
+| Scope — email | `19491dd8-d239-41a4-aa48-030c1471779d` |
+| Scope — profile | `ca45a8da-db62-41ba-b1c4-e669bf3c9a82` |
 
 To get the exact scope PKs if needed: `GET /api/v3/propertymappings/scope/?search=openid`.