Upload Tax Exempt Cert

Stream a tax-exempt certificate to R2 (firewall-safe upload proxy).

Replaces the browser's direct PUT to *.r2.cloudflarestorage.com. The client POSTs the file as multipart/form-data; the API streams it straight to R2 and returns the r2_key. After uploading, the user should PATCH /business-profile with tax_exempt_cert_r2_key set to the returned r2_key to associate the certificate with their profile.

Authorization: the user must already have a business profile. The file is written to a key namespaced under the user's id — the client cannot choose an arbitrary key.