feat: welcome OpenCoperLock.txt in each new space + feature the Linux wizard

- New non-ZK top-level spaces get a short, deletable OpenCoperLock.txt in
  their root (bilingual) explaining how spaces work and that files placed at
  the Drive ROOT via WebDAV/API stay invisible in the web app. Best-effort:
  a quota/storage hiccup never fails space creation. ZK vaults are skipped
  (the server can't write into a blind vault).
- Linux wizard: verify the URL + token (PROPFIND) before saving, with clear
  hints per HTTP status; note proxy support (curl/rclone honour HTTP(S)_PROXY).
- README: prominent 'Client quick-setup' section with the wizard one-liner
  and the Windows one-liner.

Author: softpython2884

README.md

@@ -20,6 +20,34 @@ the source.
 - **[Deployment](docs/DEPLOYMENT.md)** — bare-metal (PM2) and Docker, behind nginx.
 - **[Contributing](CONTRIBUTING.md)** · **[Security policy](SECURITY.md)**
 
+## 🚀 Client quick-setup (right-click upload & network drive)
+
+Turn any machine into a one-click uploader — right-click a file → send it straight to a
+**`ComputerShared`** space in your Drive. All of it lives in [`scripts/`](scripts/) and uses your
+personal API token over WebDAV (no new server code).
+
+**Linux — one command (interactive wizard):** installs the right-click integration and/or mounts
+your Drive as a folder (rclone). It asks for your instance URL + token once, checks the connection,
+and configures everything (it honours `HTTP(S)_PROXY` too):
+
+```bash
+curl -fsSL https://raw.githubusercontent.com/softpython2884/OpenCoperLock/main/scripts/opencoperlock-linux-wizard.sh | bash
+```
+
+**Windows — one line in PowerShell** (no admin) for the *Send to → OpenCoperLock* + *Drop on
+OpenCoperLock* right-click entries:
+
+```powershell
+irm https://raw.githubusercontent.com/softpython2884/OpenCoperLock/main/scripts/send-to/windows/install-windows.ps1 | iex
+```
+
+Also in `scripts/`: a **WebDAV network-drive** mounter for Windows, and small **right-click-menu
+tidy tools** (a GUI manager + a quick declutter for the noisy Windows 11 entries). See
+[`scripts/send-to/`](scripts/send-to/) and the **Desktop integrations** section of `/docs`.
+
+> Replace the URL host with your own instance. On the maintainer's instance it's
+> `https://copper.forgenet.fr`; the scripts default to that but prompt for yours.
+
 ## What it does
 
 - **Drive** — browse, upload (streaming), download and delete files and folders, with a

apps/api/src/routes/folders.ts

@@ -1,10 +1,52 @@
 import type { FastifyPluginAsync } from 'fastify';
+import { Readable } from 'node:stream';
+import type { Folder } from '@prisma/client';
 import { createFolderSchema, randomToken, updateFolderSchema } from '@opencoperlock/shared';
 import { prisma } from '../db.js';
 import { parseOr400 } from '../lib/validate.js';
 import { toPublicFolder } from '../lib/serialize.js';
 import { hardDeleteFolder, trashFolder } from '../services/trash.js';
+import { storeUserFile } from '../services/upload.js';
 import { audit } from '../services/audit.js';
+import type { AppContext } from '../context.js';
+
+/** Bilingual welcome note dropped into the root of each new space. Users may delete it freely. */
+function welcomeText(space: Folder): string {
+  const mode = space.isPublic
+    ? 'Public / Open (plaintext, direct URLs)'
+    : 'Server-encrypted (AES-256-GCM at rest)';
+  return [
+    `OpenCoperLock - "${space.name}"`,
+    '='.repeat(40),
+    '',
+    `[FR] Ceci est un espace (${mode}). Les fichiers que vous deposez ICI apparaissent`,
+    'dans l\'application web OpenCoperLock. Bon a savoir : un fichier place a la RACINE du',
+    'Drive via WebDAV ou l\'API ne s\'affiche PAS dans l\'app web - rangez toujours vos',
+    'fichiers dans un espace comme celui-ci. Vous pouvez supprimer ce fichier sans risque.',
+    '',
+    `[EN] This is a space (${mode}). Files you drop HERE show up in the OpenCoperLock web`,
+    'app. Heads up: a file placed at the Drive ROOT over WebDAV or the API does NOT appear',
+    'in the web app - always keep your files inside a space like this one. You can delete',
+    'this file safely.',
+    '',
+  ].join('\n');
+}
+
+/** Best-effort: put an OpenCoperLock.txt in a brand-new space's root. Never fails folder creation. */
+async function seedWelcomeFile(ctx: AppContext, ownerId: string, space: Folder): Promise<void> {
+  try {
+    await storeUserFile(ctx, {
+      ownerId,
+      folderId: space.id,
+      stream: Readable.from([Buffer.from(welcomeText(space), 'utf8')]),
+      filename: 'OpenCoperLock.txt',
+      mimetype: 'text/plain',
+      public: space.isPublic,
+    });
+  } catch {
+    /* quota exhausted, storage hiccup, etc. - the space is still created. */
+  }
+}
 
 /** Collect a folder's id plus all descendant ids (breadth-first), scoped to one owner's personal
  *  Drive (Shared-Space folders carry a spaceId and are handled by the /spaces routes). */
@@ -70,6 +112,9 @@ export const folderRoutes: FastifyPluginAsync = async (app) => {
         },
       });
       await audit(req, 'folder.create', { target: folder.id });
+      // A brand-new top-level space (not a subfolder, not a blind ZK vault) gets a short readme in
+      // its root explaining how spaces work. Best-effort and deletable.
+      if (!body.parentId && !isZk) await seedWelcomeFile(app.ctx, req.user!.id, folder);
       return reply.code(201).send({ folder: toPublicFolder(folder) });
     } catch {
       return reply.code(409).send({ error: 'A folder with that name already exists here' });

scripts/opencoperlock-linux-wizard.sh

@@ -25,12 +25,29 @@ asks() { local p="$1" a; printf '%s' "$p" >&2; IFS= read -rs a <&3 || true; prin
 
 say "=== OpenCoperLock - Linux setup wizard ==="
 echo
+if [ -n "${HTTPS_PROXY:-${https_proxy:-}}" ]; then say "(using proxy ${HTTPS_PROXY:-$https_proxy})"; fi
 
 default_base="https://copper.forgenet.fr/api/dav"
-BASE="$(ask "WebDAV base URL [$default_base]: " "$default_base")"
-BASE="${BASE%/}"
-TOKEN="$(asks "Paste your OpenCoperLock API token (ocl_...): ")"
-[ -n "$TOKEN" ] || { warn "No token provided - aborting."; exit 1; }
+
+# Collect + verify the URL and token. curl goes through HTTP(S)_PROXY automatically if set.
+while true; do
+  BASE="$(ask "WebDAV base URL [$default_base]: " "$default_base")"
+  BASE="${BASE%/}"
+  TOKEN="$(asks "Paste your OpenCoperLock API token (ocl_...): ")"
+  [ -n "$TOKEN" ] || { warn "No token provided."; continue; }
+
+  printf 'Checking the connection... ' >&2
+  code="$(curl -fsS -o /dev/null -w '%{http_code}' -u "me:$TOKEN" -X PROPFIND -H 'Depth: 0' "$BASE/" 2>/dev/null || true)"
+  if [ "$code" = "207" ]; then ok "OK (server reachable, token valid)."; break; fi
+  warn "Failed (HTTP ${code:-no response})."
+  case "$code" in
+    401) warn "  -> the token is wrong or lacks read/write scope." ;;
+    404|405) warn "  -> the URL looks off. It usually ends in /dav or /api/dav." ;;
+    000|"") warn "  -> could not reach the host (DNS/TLS/proxy/offline?)." ;;
+  esac
+  retry="$(ask "Try again? [Y/n]: " "Y")"
+  case "${retry,,}" in n|no|non) warn "Aborting."; exit 1 ;; esac
+done
 
 # Save config (readable only by you).
 umask 077