The drop: a private place per app and per forge to dump reference material the migration crew can read #645

Pillar: P4 Forge in a link (#590), under Just go forge (#643). One run, fresh from main. Planned: held until the owner sends the crew (#642).

Outcome. Per app (and per forge) the owner drops database dumps, CSVs, PDFs, CAD files, images and video; the app's crew can read it all, nobody else can, and nothing in it is public.

Today. Apps have a data directory per environment (apps/data.ts); backups have off-box destinations (src/snapshot/). No place exists for reference material.

The path: the owner on an app page has files the crew needs; primary action drag them in; next back to the app, where the crew's next run cites them.

Acceptance.

• [ ] Upload by drag-and-drop on the app page, by API (POST /api/v1/repos/:o/:n/drop, streamed) and by MCP; stored under the forge's data directory outside every environment's FORGE_APP_DATA, included in backups, with a per-forge quota shown before upload.
• [ ] Listed with type, size and a cheap preview or extract: CSV head, PDF text, SQL schema, image thumbnail; large or binary files are referenced by path, never inlined into prompts.
• [ ] That app's crew reads it inside the sandbox as a read-only mount (or a fetch tool); other apps' crews cannot (a test proves it); nothing is ever served publicly; private repository rules apply (not_found).
• [ ] Minimal, not bare: one primary next action; looks of the path at phone and desktop widths on the pull.

Done means reachable:

• Page: the app page's Drop section
• MCP: drop_put, drop_list, drop_read {path, range?}
• Test: upload, quota refusal, extract, crew mount read-only, other crew denied, anonymous not_found
• Look: the Drop with a CSV and a PDF

Removes / says what it removes: nothing removed; one new section on the app page, no new top-level screen.

Start from: src/apps/data.ts, src/crew/sandbox.ts, src/crew/workdir.ts, src/snapshot/, src/http/api.ts, src/http/mcp.ts.

Must not touch: the release workflow, the chart, the old platform's repositories (read only).

Live triage (automatic, not written by a person): filed under P4 Forge in a link, which it names.