Implement wisp: async encrypted single-retrieval file drop

Client-side libsodium encryption with the key in the URL fragment, an
Express/SQLite server holding ciphertext until a confirm-token round trip
proves successful decrypt (avoiding the delete-on-first-byte race), TTL
sweep for unclaimed drops, and a password-gated upload UI styled to match
flit. Dockerized to match the project family's conventions, with a named
volume so the DB/blobs survive redeploys, and a Gitea Actions workflow to
build and push the image.

.env.example

@@ -0,0 +1,10 @@
+# Image is built and pushed by .gitea/workflows/docker.yml
+IMAGE=your-registry.example.com/your-org/wisp:latest
+
+# Public URL is fronted by a reverse proxy — this container just needs to
+# listen on HOST_PORT.
+HOST_PORT=3040
+
+TTL_SECONDS=259200
+MAX_UPLOAD_BYTES=209715200
+UPLOAD_PASSWORD=change-me