fix(caddy): let nextcloud public share links work off-LAN

files.ginnoir.com imported internal_only, which 403s every non-LAN/tailnet
client — including anyone opening a public share link. Replace the blanket
import with an inline @blocked matcher that keeps the same IP gate but exempts
Nextcloud's public-share surface: /s/*, /public.php*, the files_sharing app,
and the static assets the share page loads.

Everything else on the host (file browser, /settings, /remote.php/dav) still
403s externally. The nextcloud.ginnoir.com alias is unchanged and stays fully
internal-only.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Caddyfile

@@ -84,7 +84,20 @@ foundry2.ginnoir.com {
 # FILE STORAGE — internal only (Nextcloud)
 # =============================================================
 files.ginnoir.com {
-	import internal_only
+	# Public share links must resolve for external users; the rest of Nextcloud
+	# stays LAN/tailnet-only. Can't use `import internal_only` here — this needs
+	# the same IP gate with a path-based exemption, so the matcher is inlined.
+	# Blocked = external client AND not a public-share path. The /core, /dist,
+	# /css, /js and theming paths are the assets the share page itself loads;
+	# without them an external visitor gets an unstyled, non-functional page.
+	@blocked {
+		not remote_ip 192.168.1.0/24 172.16.0.0/12 100.64.0.0/10 127.0.0.1
+		not path /s/* /index.php/s/* /public.php /public.php/*
+		not path /apps/files_sharing/* /index.php/apps/files_sharing/* /ocs/v2.php/apps/files_sharing/*
+		not path /core/* /dist/* /css/* /js/* /themes/* /apps/theming/* /index.php/apps/theming/*
+	}
+	respond @blocked "Access denied" 403
+
 	redir /.well-known/carddav /remote.php/dav 301
 	redir /.well-known/caldav /remote.php/dav 301
 	reverse_proxy nextcloud:80 {