Admin Upload Po Document

Stream an admin-on-behalf PO document to R2 (firewall-safe upload proxy).

Replaces the browser's direct PUT to *.r2.cloudflarestorage.com. The admin POSTs the file as multipart/form-data; the API streams it straight to R2 and returns the r2_key. The admin passes that key back as po_document_r2_key on POST /upload-po-on-behalf.

The R2 key is namespaced under the project's user_id (not the admin's id) so the user-side download path + permissions continue to work identically — locked decision #7. The admin's role is solely to perform the upload; the artifact still lives in the customer's namespace.