Upload Session Document

Upload a supporting document for an anonymous intake session.

Files can't ride a chat turn, so the chat agent's upload_document tool surfaces an upload control that posts here. We resolve the session's own claim (creating one if it doesn't exist yet), then run the SAME validated extraction pipeline as the authenticated POST /claims/{claim_id}/documents route — scoped strictly to the session's own org via a system AuthContext. Once extraction completes, the live re-scoring loop reflects the new evidence.

Isolation: the anonymous caller only controls the opaque session_token; the target claim_id and org_id are both derived server-side from the session, so a caller can never upload into another tenant's claim.