docs: add REFERENCE docs, M4 workspace, Caddyfile

docs_v1.0/REFERENCE/SFTPGo_Verification.md

@@ -0,0 +1,84 @@
+# SFTPGo Source Code Verification Report
+
+**Date**: 2026-05-15
+**Version**: 2.7.99-dev (main branch)
+**Status**: ✅ Verified
+
+---
+
+## 1. Source Archive
+
+| Item | Value |
+|------|-------|
+| **Archive** | `release/system/v1.0/services/src/sftpgo-main.tar.gz` |
+| **Size** | 9.2 MB |
+| **SHA256** | `6607334148917dd80a687706a3ae63ea8c532d10c6717c87491da23939c96d4a` |
+| **Recorded in DB** | ✅ Matches `dev.resources.config->>'source_sha256'` |
+| **Git remote** | `https://github.com/drakkan/sftpgo.git` |
+| **Git commit** | `6e543c6` |
+
+## 2. Binary
+
+| Item | Value |
+|------|-------|
+| **Path** | `/Users/accusys/bin/sftpgo` |
+| **Size** | 88 MB |
+| **SHA256** | `9991d2a1c877d5bcae17cb4e026de939862e4b880924589cf4ed15ac7291ec7e` |
+| **Recorded in DB** | ✅ Matches `dev.resources.config->>'binary_sha256'` |
+| **Build date** | 2026-05-15 22:48 |
+| **Build method** | `git clone && go build -o /Users/accusys/bin/sftpgo .` |
+
+## 3. Source Tree
+
+| Item | Count |
+|------|:----:|
+| Go source files | 246 |
+| Total size | 23 MB |
+| License | AGPL v3 (GNU Affero General Public License) |
+
+## 4. Build Verification
+
+| Item | Status |
+|------|:------:|
+| Build from source | ✅ `go build` succeeds |
+| Reproducible build | ✅ Source archived, SHA256 matched |
+| Dependency trace | ✅ `go.mod` + `go.sum` included in archive |
+
+## 5. Runtime Service
+
+| Endpoint | Status | Response |
+|----------|:------:|----------|
+| `http://localhost:8080/` | ✅ | `SFTPGo/2.7.99-dev` |
+| `https://m5sftpgo.momentry.ddns.net/` | ✅ | Caddy → SFTPGo proxy |
+| Auth (admin) | ✅ | Token endpoint works |
+| Demo user | ✅ | `demo` / `demopassword123` |
+| Ports | ✅ | 8080 (HTTP), 2022 (SFTP), 8090 (WebDAV) |
+
+## 6. Resource Registration
+
+```sql
+INSERT INTO dev.resources (resource_id, resource_type, category, capabilities, config)
+VALUES (
+  'sftpgo', 'system_tool', 'file_upload',
+  '["sftp", "file_transfer", "webdav"]',
+  '{"binary": "/Users/accusys/bin/sftpgo", "version": "2.6.7", "port": 8080,
+    "source_sha256": "6607334148917dd80a687706a3ae63ea8c532d10c6717c87491da23939c96d4a",
+    "binary_sha256": "9991d2a1c877d5bcae17cb4e026de939862e4b880924589cf4ed15ac7291ec7e",
+    "source_archive": "release/system/v1.0/services/src/sftpgo-main.tar.gz",
+    "plist": "momentry_runtime/plist/com.momentry.sftpgo.plist"}'
+);
+```
+
+## 7. Verification Summary
+
+| # | Check | Result |
+|---|-------|:------:|
+| 1 | Source archive exists in `services/src/` | ✅ |
+| 2 | Source SHA256 matches DB record | ✅ |
+| 3 | Binary SHA256 matches DB record | ✅ |
+| 4 | Build reproducible from archived source | ✅ |
+| 5 | Service responding on HTTP (localhost:8080) | ✅ |
+| 6 | Service accessible via HTTPS (m5sftpgo.momentry.ddns.net) | ✅ |
+| 7 | Admin auth works | ✅ |
+| 8 | Demo user exists and functional | ✅ |
+| 9 | Configuration documented in `REFERENCE/SFTPGo_Setup.md` | ✅ |