Depends on #9 for session loading and identity. Upload flow: read file → detect MIME → generate content key → encrypt blob → upload blob → wrap key to owner → build Document record → create record. Rejects files >50MB (PDS blob limit).
Depends on #9 for session loading and identity. Upload flow: read file → detect MIME → generate content key → encrypt blob → upload blob → wrap key to owner → build Document record → create record. Rejects files >50MB (PDS blob limit).