feat: file proxy — serve HL Patents Style.dotm from Gitea with cache

Add GET /files/{filename} route (behind auth) that proxies files from
Gitea raw URLs with in-memory caching. Uses SHA-based cache invalidation:
checks Gitea commit API every 5 min, only re-downloads when file changes.

- internal/handlers/files.go: proxy handler with SHA-based cache
- POST /api/files/refresh: cache-bust endpoint
- GITEA_TOKEN env var for private repo access
- Download card on landing page with i18n DE/EN

cmd/server/main.go

@@ -23,8 +23,13 @@ func main() {
 
 	client := auth.NewClient(supabaseURL, supabaseAnonKey)
 
+	giteaToken := os.Getenv("GITEA_TOKEN")
+	if giteaToken == "" {
+		log.Println("GITEA_TOKEN not set — file proxy will not be able to access private repos")
+	}
+
 	mux := http.NewServeMux()
-	handlers.Register(mux, client)
+	handlers.Register(mux, client, giteaToken)
 
 	log.Printf("patholo server starting on :%s", port)
 	if err := http.ListenAndServe(":"+port, mux); err != nil {