Upload With Token

Spend an upload token and store the raw body as an attachment.

This route carries no Bearer header — the token in the path is the whole credential, and resolve_upload_token restores the owner by DB lookup, so §14.6 tenant isolation holds for an anonymous request.

The token is consumed FIRST, before a single byte of the body is read: the credential must be dead the moment it is presented, whatever happens next. Everything after that is the ordinary path — magic-byte mime sniffing, the size cap, upload-before-INSERT ordering and the background vision pass are the same code the dashboard uses.

The limit is looser than the 20/min on the authenticated routes because slowapi keys an anonymous request by IP, which one office NAT would share. The real control here is the token itself: opaque, single-use, 10-minute TTL.