docs(sftp): document server operations (#3391)

Adds an operator guide for the SFTP server: recommended
configuration, the path model, host keys on Unix and Windows, the
environment variable reference, session cleanup behaviour, IAM
policy requirements per SFTP operation, client compatibility
notes, multipart upload sizing and cleanup, and the log lines
worth alerting on.

Corrects documentation the platform change left stale. The module
overview and the UnsupportedPlatform error text still described
Windows as unsupported. A source comment referenced a document
that does not exist in the repository and now points at the new
guide. The changelog adds the two host-key reload variables
missing from its environment list, describes the banner variable
as the SSH identification string, and corrects the upload size
cap and compliance case count.

crates/protocols/src/sftp/config.rs

@@ -85,12 +85,12 @@ pub enum SftpInitError {
     #[error("SSH server error: {0}")]
     Server(String),
 
-    /// The host running the binary is not a Unix-family target. The
-    /// host-key permission enforcement (the owner-only mode-bit check)
-    /// requires Unix mode bits and has no equivalent on this platform,
-    /// so SFTP refuses to start rather than load host keys with weaker
-    /// guarantees.
-    #[error("SFTP requires a Unix-family host (current OS: {os})")]
+    /// The host running the binary is neither a Unix-family target nor
+    /// Windows. Unix enforces owner-only host-key mode bits and Windows
+    /// trusts operator-managed NTFS ACLs, but neither mechanism exists on
+    /// other targets, so SFTP refuses to start rather than load host keys
+    /// with weaker guarantees.
+    #[error("SFTP requires a Unix-family or Windows host (current OS: {os})")]
     UnsupportedPlatform { os: String },
 }
 

crates/protocols/src/sftp/driver.rs

@@ -52,7 +52,7 @@ use uuid::Uuid;
 /// Try-acquire returns immediately. If no permit is available the abort
 /// is skipped and the orphaned upload_id is reclaimed by the bucket
 /// AbortIncompleteMultipartUpload lifecycle rule documented in
-/// OperatorDeploymentNotes.md.
+/// docs/operations/sftp.md.
 const ABORT_PERMITS_FLOOR: usize = 8;
 const ABORT_PERMITS_CEILING: usize = 128;
 static ABORT_PERMITS: LazyLock<Arc<Semaphore>> = LazyLock::new(|| {
@@ -68,8 +68,8 @@ pub struct SftpDriver<S: StorageBackend + Send + Sync + 'static> {
     pub(super) storage: Arc<S>,
     pub(super) session_context: SessionContext,
     /// When true, write operations (OPEN with any write flag, WRITE,
-    /// REMOVE, MKDIR, RMDIR, RENAME) are rejected with PermissionDenied
-    /// before any backend call runs.
+    /// SETSTAT, FSETSTAT, REMOVE, MKDIR, RMDIR, RENAME) are rejected with
+    /// PermissionDenied before any backend call runs.
     pub(super) read_only: bool,
     pub(super) handles: HashMap<String, HandleState>,
     /// S3 multipart part size in bytes. Bytes accumulate in the per-handle

crates/protocols/src/sftp/mod.rs

@@ -81,8 +81,10 @@
 //! handler dispatch type. SftpError is the error type returned by SFTP
 //! operations.
 //!
-//! Platform support. Host-key permission enforcement uses Unix mode bits.
-//! On non-Unix targets SftpConfig::load_host_keys returns
+//! Platform support. On Unix the host-key loader enforces owner-only mode
+//! bits. On Windows it loads host keys without a mode check and trusts the
+//! operator-managed NTFS ACLs on the key directory. On targets that are
+//! neither Unix nor Windows, SftpConfig::load_host_keys returns
 //! SftpInitError::UnsupportedPlatform and the SFTP listener does not start.
 //!
 //! Peer-initiated signal requests on an open SFTP channel are intercepted