Mint a resumable GCS upload session for this user's half of a conversation.

The object name is server-chosen (dialogue/{sessionId}/{uploadId}.wav) and the session is bound to the caller's Origin — the browser PUTs the bytes directly. A repeat call while an attempt is open supersedes it; after /complete → 409.

Two forms (module docstring): with sizeBytes the recording already exists, so its declared length bounds the session and the duration/size rules run here; without it the call has only just started and both the length and the rules move to /complete. Either way the caller gets a one-time complete token, which is what makes that /complete survive a cookie-less webview.