Upload a file to the project's cloud storage bucket. The server generates a UUID-based filename to prevent path traversal attacks — client-supplied names are never used directly. An optional path body field provides a folder hint for organizing uploads (e.g. images/avatars).

Security: Dangerous file types (executables, scripts, HTML, etc.) are blocked. Projects may require a Bearer JWT token when the storage security policy has require_auth enabled. A signed-in uploader is recorded on the file, which is what lets that same user delete it later with remove.

{
  "path": "images/avatars"
}