Create a signed upload URL for an app

Creates or updates an app and returns pre-signed upload URLs for each file. Honours an optional Idempotency-Key header: a retry with the same key and body returns the same app and version with freshly signed URLs and Idempotent-Replayed: true, and never creates a second version. An Idempotency-Key is honoured for 7 days; after that it behaves like a fresh request. A replay whose version was deleted is a 404; a replay whose version already left the queued state is a 409 idempotency_key_consumed; a replay that cannot get the version lock within 5 s is a 409 idempotency_request_in_progress. Every response produced by a replay, including those 404/409 errors, carries Idempotent-Replayed: true. A same-key request still in flight after a 5 s wait is a 409 idempotency_request_in_progress (retry after Retry-After). If signing fails, nothing is persisted (with or without a key) and the same request, key included, can be retried.