Upload API

POST /api/uploads

Requires Authorization: Bearer <token> and ADMIN or MANAGER role. Multipart form with a file field.

Stores the object in the R2 bucket bound as BUCKET (policy name r2-admin-assets).

{
  "key": "uploads/550e8400-e29b-41d4-a716-446655440000-report.pdf",
  "size": 102400,
  "url": "/api/uploads/uploads%2F550e8400-e29b-41d4-a716-446655440000-report.pdf"
}

Returns 503 when the R2 binding is not configured.

GET /api/uploads/*

Retrieve an uploaded object by key (admin/manager only). Keys contain a / prefix segment (uploads/…); the URL path uses percent-encoding (%2F) or a wildcard path segment.