Upload an evidence blob (bytes)

Takes BYTES into custody: multipart/form-data with the content in the file part and the asset metadata as text parts. The server owns identity here — byteHash (sha256 of what it received), byteLength and storageRef are computed, never asserted — so the registered asset is blob-backed with availability derived as hot. Media types are an explicit conservative allowlist checked AGAINST the declared modality (application/json, application/pdf, application/vnd.openxmlformats-officedocument.presentationml.presentation, application/vnd.openxmlformats-officedocument.spreadsheetml.sheet, application/vnd.openxmlformats-officedocument.wordprocessingml.document, audio/aac, audio/flac, audio/mp4, audio/mpeg, audio/ogg, audio/wav, image/avif, image/gif, image/jpeg, image/png, image/webp, message/rfc822, text/csv, text/markdown, text/plain, video/mp4, video/quicktime, video/webm); anything else, including SVG, HTML, archives and application/octet-stream, is a 400. Transfer is capped at min(EVIDENCE_MAX_BYTES, 64 MiB) — an over-cap part is refused mid-upload with 413. Uploaded bytes are EXTERNAL INGEST by definition, so the asset registers with origin external_ingest and is SCANNED before it becomes dispatchable: a clean verdict answers 201, a rejection answers 422 with the row tombstoned and the bytes deleted, and a scan hook that cannot decide answers 201 with quarantineStatus: "scanning" (still dispatch-denied — the surface never fails open). An optional packId starts a FIRE-AND-FORGET processor dispatch that can never fail the upload. Same-user re-upload of identical bytes dedupes; a different principal gets a bare 409. Answers a bare 404 until EVIDENCE_BLOB_UPLOAD_ENABLED=1 (raised before the body is parsed); answers 503 while EVIDENCE_SUBSTRATE_ENABLED or EVIDENCE_QUARANTINE is off, or when no storage adapter is configured. Source: src/evidence/evidence-ingest.controller.ts.

Required scope: brain:write.