Access control for file serving

Authenticated user only for now

conf/default.php

@@ -19,3 +19,8 @@ $conf['gallery_thumb_scale'] = 1;
 
 // Local client service used by {{open>...}}.
 $conf['open_service_url'] = 'http://127.0.0.1:8765';
+
+// Access allowlist for the file-serving endpoint (file.php).
+// Empty means: any authenticated user may access. Anonymous users are denied.
+// Use '@group' to allow a whole group.
+$conf['access_allow'] = '';