Stage a document upload

Mints a short-lived presigned S3 PUT URL the client uploads a file to directly, plus the opaque object key to reference it. After the PUT succeeds, pass the key in a work-item action (e.g. court pickup's submit documentKeys) to attach the file. The upload is generic (not yet bound to a work item); an unreferenced upload simply expires from the client's perspective and is never attached. Work item documents are PDFs of at most 150 MB. The URL is signed for application/pdf, so the PUT must send Content-Type: application/pdf or S3 rejects it. Attaching a file that isn't a PDF, is larger than 150 MB, or was never uploaded fails the action with 422.