Upload a file

Uploads a file in one request, for a backend that holds a session or an API token, and for the Elaichi app’s Files screen (which uses it for Upload). Two forms, told apart by X-Filename (or ?filename=):

• With it, the body is the file (Content-Type is the declared type, Content-Length is required, at most 95 MiB). Streamed straight into storage with the size counted on the bytes actually read, so a header that lies is caught mid-stream and nothing is kept. 411 upload_length_required without a length, 413 upload_too_large over the limit. A raw upload of a JSON file sends X-Filename, so it is never taken for the second form.
• Without it, the body is JSON { filename, content, encoding: utf8 | base64, mime? } for content the client wrote itself, at most 1 MiB of decoded content (413 inline_content_too_large; the body is never buffered past that, whatever it declares).

Either way the answer is 201 { file }, the file as GET /file/{id} reads it, owned by the caller and kept for 7 days. The stored type is read from the bytes, never taken from the declaration. origin is upload for a person’s session, api for a token. Audited as file.uploaded.