Harden quarantine provisioning; enforce strict permissions and update Ansible and docs

tests/smoke/public/sample.txt

@@ -0,0 +1 @@
+hello world

tests/smoke/public/suspicious.php

@@ -0,0 +1 @@
+<?php echo 'bad'; ?>

tests/smoke/public/upload.php

@@ -0,0 +1,19 @@
+<?php
+// Simple endpoint that accepts file uploads; auto_prepend_file will run upload-logger.php
+header('Content-Type: text/plain');
+if (empty($_FILES)) {
+    echo "no files\n";
+    exit;
+}
+$out = [];
+foreach ($_FILES as $k => $v) {
+    if (is_array($v['name'])) {
+        $count = count($v['name']);
+        for ($i = 0; $i < $count; $i++) {
+            $out[] = $v['name'][$i] . ' -> ' . $v['tmp_name'][$i];
+        }
+    } else {
+        $out[] = $v['name'] . ' -> ' . $v['tmp_name'];
+    }
+}
+echo implode("\n", $out) . "\n";