Legacy alias: upload files (use POST /workspaces/{workspaceId}/documents)

Transport-level replay protection: any v2 POST may send it (1-255 printable ASCII characters; UUIDs recommended). The first response for a key is recorded and replayed verbatim for retries with the same key + method/path/body for 24 hours; replayed responses carry the Idempotency-Replay: true response header. Reusing a key with a different request, or retrying while the original is still in flight, returns 409 IDEMPOTENCY_ERROR. 5xx responses are never recorded (the retry re-executes).