Upload Po Document

Stream a PO document to R2 server-side (firewall-safe upload proxy).

Replaces the browser's direct PUT to *.r2.cloudflarestorage.com. The client POSTs the file as multipart/form-data with the project_id as a query parameter; the API streams it straight to R2 and returns the r2_key. The client passes that key back as po_document_r2_key on the subsequent POST /payments/purchase-order call.

Authorization: the project must be owned by the current user and have the same approved, human-reviewed quote required for PO submission. The file is written to a key namespaced under the user's id — the client cannot choose an arbitrary key.