NE Hub: Seafile, OnlyOffice, Plex, calendar and mail in one PWA

- Mobile-first PWA (phone tab bar with More menu, iPad/desktop rail)
- Passkey (WebAuthn) sign-in gates the whole app; first passkey via setup code
- Files: Seafile browse/upload/new doc/rename/move/share link/preview/delete
- In-app OnlyOffice editing with JWT-signed configs and save-back to Seafile
- Plex music player via plex.tv sign-in and a server-side proxy
- Calendar agenda from private ICS links (recurrence + time zones)
- Search, Home dashboard, webmail deep links, audiobooks frame
- Dockerfile, compose, and a Gitea Actions workflow that builds the image

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

README.md

@@ -0,0 +1,44 @@
+# NE Hub
+
+One installable web app (PWA) for Seafile, OnlyOffice and your four webmail accounts.
+Mobile-first; bottom tabs on phones, side rail on iPad and desktop (tuned for 12.9" at 1024 and 1366 wide).
+
+## Configure
+
+    cp .env.example .env     # set ONLYOFFICE_JWT_SECRET (same value as the Document Server) and PUBLIC_URL
+
+`PUBLIC_URL` must be an address the OnlyOffice server can reach (not localhost): it posts saved edits back there.
+
+## Run
+
+    docker compose up -d --build     # http://localhost:8080
+    # or: node server.js
+
+Put it behind your reverse proxy with HTTPS (needed for "Add to Home Screen" and the service worker),
+e.g. hub.necloud.us. Settings: `SEAFILE_URL`, `ONLYOFFICE_URL` env vars in docker-compose.yml.
+
+## What each part does
+
+- **Files**: signs in with your Seafile account, browses libraries, uploads, creates folders, downloads, deletes.
+  The server proxies `/sf/*` to Seafile because Seafile sends no CORS headers. Token lives in the browser only.
+  Office files open in Seafile's own OnlyOffice integration.
+- **Edit here**: opens docs inside the app via OnlyOffice. The server signs each editor config with the JWT secret and saves edits back to Seafile.
+- **Music**: Plex player. Sign in goes through plex.tv (no password handled), the server proxies your Plex server and adds the token itself, and a mini player keeps playing as you move between tabs.
+- **Audio**: embeds audiobooks.necloud.us; sign-in details saved in Settings can be copied with one tap.
+- **Office**: embeds onlyoffice.necloud.us in a frame, with an "open in new tab" fallback if it blocks framing.
+- **Mail**: deep links to Gmail, Outlook.com, Microsoft 365 and iCloud webmail (inbox + compose).
+  Providers forbid framing, and a real unified inbox would need Google/Azure app registrations.
+
+## Build and deploy with Gitea
+
+`.gitea/workflows/build.yml` builds the container on every push to `main` (and `v*` tags) and pushes it to
+`git.necloud.us/nate/hub` (tags: `latest`, short commit sha, git tag). Multi-arch: amd64 + arm64.
+
+One-time setup in Gitea: create an access token with the **write:package** scope, then add it to the repo under
+Settings -> Actions -> Secrets as `REGISTRY_TOKEN` (optionally `REGISTRY_USER`). The runner needs Docker.
+
+On the server:
+
+    cp .env.example .env                # fill in secrets, PUBLIC_URL, etc.
+    docker compose pull && docker compose up -d
+    docker compose logs hub | grep "Setup code"   # first sign-in: create your passkey