Archive location (Gitea issue 7): ARCHIVE_ROOT, Admin file-locations API, archive-copy job, doctor check

A filed packet's sealed data book, documents and a manifest are copied to the archive folder by the worker.
A failed copy never blocks filing: it is retried with backoff and raises the archive_failed condition.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

deploy/compose.ci.yaml

@@ -36,12 +36,36 @@ services:
     volumes:
       - ci-dc-export:/etc/ssl/pstest:ro    # the DC's CA, LDAP_CA_BUNDLE=/etc/ssl/pstest/ca.pem
 
+  # The archive share stand-in (Gitea issue 7): a volume at /archive (ARCHIVE_ROOT in ci.env) with the folder
+  # /archive/packets owned by uid 10001, so the e2e scenario can save "packets" under File locations.
+  archive-init:
+    build: *build
+    image: ${IMAGE:-packetstation:ci}
+    pull_policy: build
+    user: "0:0"
+    # Once per volume: root may not chmod the folder after it belongs to 10001 (no CAP_FOWNER).
+    entrypoint:
+      - sh
+      - -c
+      - test -d /archive/packets || { mkdir /archive/packets && chmod 0750 /archive/packets && chown 10001:10001 /archive/packets; }
+    volumes:
+      - ci-archive:/archive
+    network_mode: none
+    security_opt:
+      - no-new-privileges:true
+    cap_drop:
+      - ALL
+    cap_add:
+      - CHOWN
+    restart: "no"
+
   app:
     build: *build
     image: ${IMAGE:-packetstation:ci}
     pull_policy: build
     volumes:
       - ci-dc-export:/etc/ssl/pstest:ro
+      - ci-archive:/archive
     # Playwright reaches the app as ps-app, never as "app": "app" is a top-level domain on
     # Chromium's HSTS preload list, so http://app:8000 is forced to TLS and fails.
     networks:
@@ -52,6 +76,8 @@ services:
     depends_on:
       samba-dc:
         condition: service_healthy
+      archive-init:
+        condition: service_completed_successfully
 
   worker:
     build: *build
@@ -60,6 +86,10 @@ services:
     volumes:
       - ci-dc-export:/etc/ssl/pstest:ro
       - ../tests/fixtures/generated:/fixtures:ro   # synthetic feed and drawings; the scenario switches state
+      - ci-archive:/archive
+    depends_on:
+      archive-init:
+        condition: service_completed_successfully
 
   # Throwaway Samba AD DC (PSTEST.LOCAL) so LDAP sign-in runs over real TLS in CI.
   # Built from deploy/samba/. Runs as root, as Samba needs. No published port.
@@ -127,6 +157,7 @@ services:
 volumes:
   ci-dc-data: {}
   ci-dc-export: {}
+  ci-archive: {}
 
 secrets:
   samba_admin_password: