Upload proxy (local/proxy storage only)

The PUT target that POST /documents/uploads returns as uploadUrl only on the local/proxy storage backend (local dev / in-cluster MinIO). On real S3/R2 the uploadUrl is an absolute presigned URL and this route is never touched. Authorized by the upload binding token (sent as x-upload-token), not the normal bearer credential. Send the raw file bytes as the request body.