NE Hub: Seafile, OnlyOffice, Plex, calendar and mail in one PWA

- Mobile-first PWA (phone tab bar with More menu, iPad/desktop rail)
- Passkey (WebAuthn) sign-in gates the whole app; first passkey via setup code
- Files: Seafile browse/upload/new doc/rename/move/share link/preview/delete
- In-app OnlyOffice editing with JWT-signed configs and save-back to Seafile
- Plex music player via plex.tv sign-in and a server-side proxy
- Calendar agenda from private ICS links (recurrence + time zones)
- Search, Home dashboard, webmail deep links, audiobooks frame
- Dockerfile, compose, and a Gitea Actions workflow that builds the image

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.env.example

@@ -0,0 +1,11 @@
+# Copy to .env and fill in. Must match the Document Server's JWT secret.
+ONLYOFFICE_JWT_SECRET=
+# Address the OnlyOffice server can reach this app on (used for save-back callbacks), e.g. https://hub.necloud.us
+PUBLIC_URL=
+SEAFILE_URL=https://seafile.necloud.us
+ONLYOFFICE_URL=https://onlyoffice.necloud.us
+# Optional: keeps Plex/session cookies valid across restarts. Any long random string.
+COOKIE_SECRET=
+AUDIOBOOKS_URL=https://audiobooks.necloud.us
+# First-time passkey enrolment. If unset, a random code is printed in the server log while no passkey exists.
+HUB_SETUP_CODE=