Harden quarantine provisioning; enforce strict permissions and update Ansible and docs

tests/smoke/create_test_files.ps1

@@ -0,0 +1,4 @@
+# Create sample files for upload smoke tests
+Set-Content -Path .\tests\smoke\public\sample.txt -Value "hello world"
+Set-Content -Path .\tests\smoke\public\suspicious.php -Value "<?php echo 'bad'; ?>"
+Write-Host "Created sample files."

tests/smoke/public/sample.txt

@@ -0,0 +1 @@
+hello world

tests/smoke/public/suspicious.php

@@ -0,0 +1 @@
+<?php echo 'bad'; ?>

tests/smoke/public/upload.php

@@ -0,0 +1,19 @@
+<?php
+// Simple endpoint that accepts file uploads; auto_prepend_file will run upload-logger.php
+header('Content-Type: text/plain');
+if (empty($_FILES)) {
+    echo "no files\n";
+    exit;
+}
+$out = [];
+foreach ($_FILES as $k => $v) {
+    if (is_array($v['name'])) {
+        $count = count($v['name']);
+        for ($i = 0; $i < $count; $i++) {
+            $out[] = $v['name'][$i] . ' -> ' . $v['tmp_name'][$i];
+        }
+    } else {
+        $out[] = $v['name'] . ' -> ' . $v['tmp_name'];
+    }
+}
+echo implode("\n", $out) . "\n";