Add OnlyOffice integration docs and hairpin NAT fix

Seafile.md

@@ -36,6 +36,26 @@ Credentials stored in Vaultwarden AI collection:
 | `seafile-redis` | `redis` | Cache |
 | `seafile-caddy` | `lucaslorentz/caddy-docker-proxy` | Internal proxy (port 8077, unused) |
 
+## OnlyOffice Integration
+
+Online editing of `.docx`, `.xlsx`, `.pptx` via OnlyOffice Document Server.
+
+- **URL**: `https://office.alogins.net`
+- **Port**: `127.0.0.1:6233` (proxied via Caddy)
+- **JWT secret**: stored in Vaultwarden as `ONLYOFFICE_JWT_SECRET`
+
+`seahub_settings.py` (inside container at `/shared/seafile/conf/`):
+
+```python
+ENABLE_ONLYOFFICE = True
+ONLYOFFICE_APIJS_URL = 'https://office.alogins.net/web-apps/apps/api/documents/api.js'
+ONLYOFFICE_FILE_EXTENSION = ('doc', 'docx', 'ppt', 'pptx', 'xls', 'xlsx', 'odt', 'fodt', 'odp', 'fodp', 'ods', 'fods', 'csv', 'ppsx', 'pps')
+ONLYOFFICE_EDIT_FILE_EXTENSION = ('docx', 'pptx', 'xlsx')
+ONLYOFFICE_JWT_SECRET = '<from Vaultwarden>'
+```
+
+**Hairpin NAT fix**: OnlyOffice server must call back to Seafile to download files and post save events. Since the public IP is unreachable from inside Docker, `onlyoffice.yml` uses `extra_hosts: docs.alogins.net:host-gateway` so callbacks route via the host's Caddy instead of the public IP.
+
 ## Notes
 
 - `SEAFILE_SERVER_PROTOCOL=https` required — setting it to `http` causes CSRF errors when accessed via HTTPS