sftp: files in the mount, conflicts kept, revoked keys locked out

The mount listed documents and folders only. File nodes now appear
under their own name, with a later file that shares it told apart by its
id as in the mirror's files/ view. They are read from uploads/ a piece at
a time, and anything that is not a .md is streamed into a .part on disk,
up to the upload limit, and becomes a file node on close. A copy that
used to vanish at the end of the session is now kept. Writing over a
file gives it new bytes under a new id, rename and remove work as they
do for documents, and a dotted temp file renamed onto a real name is
kept as that file, which is how rsync and most editors save. Sealed
files are listed and refuse to open.

Closing a document that was saved in the browser while the handle was
open no longer overwrites that save: the SFTP write lands beside it as
<name>-conflict.md. The session's key is checked again whenever a file
or a directory is opened, so deleting a key ends a live mount. Adding or
removing a key now triggers a backup, like every other write.

README.md

@@ -189,8 +189,18 @@ arrives, never held in memory, so the only ceiling is `WORKSPACE_MAX_UPLOAD_MB`
 (1024 by default) — which is per request, so a proxy in front needs a body
 limit at least that large too.
 
-The SFTP mount does not show files yet; a folder that holds only files lists
-as empty there.
+The SFTP mount shows files beside the documents, under their own names — a
+later file that shares one is told apart by its id, `slides (42).pdf` — and
+anything copied in that is not a `.md` becomes a file in the tree, streamed to
+disk under the same size limit. A sealed file is listed but does not open
+there. Editor droppings — swap files, `~` backups, dotted temp files — stay in
+memory for the session, and a dotted temp file renamed onto a real name is kept
+as that file, which is how `rsync` and most editors save.
+
+If a document is saved in the browser while an SFTP client holds it open, the
+client's save does not overwrite it: it lands beside it as `<name>-conflict.md`,
+and both are kept. Deleting a key in the browser ends what that key mounted,
+not just its next login.
 
 ## The vault