Upload single picture in batch - ASYNC WORKFLOW with duplicate detection.

Returns immediately with workflow_id. Frontend must poll GET /workflow/{workflow_id}/status for completion.

Workflow steps (background):

1. Upload to EXTERNAL storage (nachet-original)
2. Azure Defender malware scan
3. Sanitization function
4. Store in INTERNAL storage (nachet-sanitized)

Security:

• Requires authentication (Bearer token)
• Rate limited to 60 requests/minute
• Validates session ownership, expiration, and active status
• Validates seed exists
• Reuses existing DBOS workflow (Defender + sanitization)

Request: - session_id: From /new-batch-import (must be active and not expired) - seed_id: UUID of existing seed record (validated before upload) - tray_code: Sample tray identifier (A-E) - sample_id: Becomes picture.name field - device_*_id, magnification: Device metadata - image: Base64 data URL

Response (Success): - workflow_id: Poll /workflow/{id}/status - picture_id: Image UUID

Response (Duplicate): - 400 BAD_REQUEST with existing picture_id - Both uploaded_count and duplicate_count incremented - No workflow enqueued

Response (Session Expired): - 400 BAD_REQUEST "Session expired (24-hour limit exceeded)"

Response (Invalid Seed): - 400 BAD_REQUEST "Seed not found: {seed_id}"

Duplicate Handling:

• Detects duplicates via SHA256 hash collision
• Increments session uploaded_count and duplicate_count
• Returns error with existing picture_id
• Does NOT create new picture or enqueue workflow

Session Completion:

• When uploaded_count >= file_count, session marked inactive
• Both successful uploads and duplicates count toward file_count

Note: FRONTEND MODIFICATION REQUIRED for async polling. See BATCH_UPLOAD_IMPLEMENTATION_PLAN.md for details.