Encrypt uploads in the browser and send them in chunks

A 6 GB upload kept a customer waiting long after its progress bar
reached 100%. The server wrote every upload three times: PHP's
temporary file, Livewire's copy of it ("Processing files...") and the
encrypted file ("Create Share Link"), each a full rewrite of a slow
disk. The unencrypted copy also stayed behind in livewire-tmp.

Now the uploader's browser encrypts each file in 16 MB chunks with
WebCrypto and PUTs them one at a time; the server checks each chunk in
memory and writes it once, already encrypted. Creating the share only
wraps its key and saves the options. A 200 MB upload through the
Docker image took 2.8 s, and its download matched byte for byte.

- SEALCHK2: a 19-byte header (chunk size, 7-byte nonce prefix), then
  ciphertext and tag per chunk. Each nonce holds the chunk index and a
  last-chunk flag (the STREAM construction), so cut or reordered files
  fail to decrypt. SEALCHK1 and the single-block format still read.
- Envelope encryption: one random key per share. With a password it is
  wrapped with Argon2id (sodium, libsodium's interactive limits) in
  shares.wrapped_key, which names its parameters. Password shares from
  before keep their PBKDF2-derived key.
- The upload page registers each selection with FileUploader into a
  pending share of its own, lists the files with their progress, retries
  a failed chunk after 1-16 s, then offers Retry; Remove and Cancel
  abort. UploadChunkController only accepts chunks from the session that
  started the share: a repeat is acknowledged, a skip gets 409 with the
  count stored. Chunks go out as Blobs, which Chromium sends about eight
  times faster than ArrayBuffers.
- Uploads need a secure context: over plain HTTP the page says HTTPS is
  needed and takes no files. The Docker image gains AUTO_HTTPS, which
  serves Let's Encrypt on 443 for SERVER_NAME and redirects 80; without
  it the container stays on HTTP 80 behind a proxy. docker/Caddyfile was
  never loaded and is gone; docker/healthcheck.sh covers both modes.
- "Download all" streams the ZIP with maennchen/zipstream-php (STORE,
  ZIP64) instead of decrypting whole files into memory and writing the
  archive unencrypted to /tmp.
- Pending shares count towards the quota, stay out of the admin
  dashboard and 404 everywhere else. shares:cleanup deletes uploads idle
  for 4 hours and Livewire temporary files older than that.
- PHP's upload limits no longer cap the admin's max file size and
  default to 64M; LIVEWIRE_MAX_UPLOAD_TIME is gone and
  UPLOAD_CHUNK_SIZE_MB is new.
- Tests cover the format, key wrapping, registration limits, the chunk
  endpoint's answers, completing a share, the streamed ZIP, cleanup,
  and in Chromium a real chunked upload and the HTTPS warning; the
  selected-files overflow test runs again. README, website, CHANGELOG
  and .ai/rules follow.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docker-compose.example.yml

@@ -4,7 +4,7 @@
 #
 # Quick start:
 #   1. Copy this file:  cp docker-compose.example.yml docker-compose.yml
-#   2. Edit the settings below (APP_URL and SERVER_NAME are required)
+#   2. Edit the settings below (APP_URL is required; uploads need HTTPS, see below)
 #   3. Start:  docker compose up -d
 #   4. Open your browser to your configured domain
 #
@@ -22,7 +22,7 @@ services:
     restart: unless-stopped
     ports:
       - "80:80"       # HTTP
-      - "443:443"     # HTTPS (auto TLS via Let's Encrypt when SERVER_NAME is a real domain)
+      - "443:443"     # HTTPS (a Let's Encrypt certificate with AUTO_HTTPS)
       - "443:443/udp" # HTTP/3 (QUIC)
     volumes:
       - sealshare_storage:/app/storage/app   # Uploaded & encrypted files
@@ -32,9 +32,15 @@ services:
     environment:
       # --- REQUIRED ---
       APP_URL:              # Your full URL, e.g. https://share.example.com
-      SERVER_NAME:          # Your domain for auto-TLS, e.g. share.example.com (use "localhost" for local testing)
       # APP_KEY:            # Auto-generated if not set. Copy from logs to persist across restarts.
 
+      # --- HTTPS ---
+      # Files are encrypted in the uploader's browser, which browsers only allow over HTTPS (or on
+      # localhost). Either let this container fetch a Let's Encrypt certificate (ports 80 and 443
+      # reachable from the internet), or put a reverse proxy that terminates TLS in front of port 80.
+      # AUTO_HTTPS: "true"
+      # SERVER_NAME: share.example.com  # The domain to fetch the certificate for (only with AUTO_HTTPS)
+
       # --- Optional: Application ---
       # APP_ENV: production
       # APP_DEBUG: "false"
@@ -53,15 +59,17 @@ services:
       # OCTANE_HTTPS: "false"           # Set to "true" when using HTTPS
       # OCTANE_MAX_EXECUTION_TIME: 300  # Max request execution time (seconds)
 
-      # --- Optional: PHP upload limits ---
-      # PHP_UPLOAD_MAX_FILESIZE: "4G"   # Max single file size
-      # PHP_POST_MAX_SIZE: "4G"         # Max total request size
-      # PHP_MAX_EXECUTION_TIME: "300"   # Upload timeout in seconds
-      # PHP_MAX_INPUT_TIME: "300"       # Input processing timeout
-      # PHP_MEMORY_LIMIT: "512M"        # PHP memory limit
-      # LIVEWIRE_MAX_UPLOAD_TIME: "30"  # Minutes a single upload may take (raise for large files on slow links)
+      # --- Optional: Uploads ---
+      # UPLOAD_CHUNK_SIZE_MB: "16"      # Each encrypted chunk the browser sends; a reverse proxy must accept a little more
+
+      # --- Optional: PHP limits ---
+      # PHP_UPLOAD_MAX_FILESIZE: "64M"  # Only for the admin's logo upload: shares upload in chunks
+      # PHP_POST_MAX_SIZE: "64M"
+      # PHP_MAX_EXECUTION_TIME: "300"
+      # PHP_MAX_INPUT_TIME: "300"
+      # PHP_MEMORY_LIMIT: "512M"
     healthcheck:
-      test: ["CMD", "curl", "--silent", "--fail", "http://localhost/up"]
+      test: ["CMD", "/app/docker/healthcheck.sh"]
       interval: 30s
       timeout: 5s
       start_period: 10s