#97 Move upload logic into opake-core documents module

Extract encrypt+upload+create-record logic from CLI upload.rs into opake-core/src/documents/upload.rs. Same pattern as download.

Core function signature (roughly):

pub async fn encrypt_and_upload(
    client: &XrpcClient<impl Transport>,
    plaintext: &[u8],
    filename: &str,
    mime_type: &str,
    owner_did: &str,
    owner_pubkey: &[u8; 32],
    tags: Vec<String>,
    rng: &mut (impl CryptoRng + RngCore),
) -> Result<String, Error>  // returns AT-URI

What moves to core:

• generate_content_key, encrypt_blob, upload_blob, wrap_key, build Document, create_record
• DOCUMENT_COLLECTION const (already in mod.rs)
• MAX_BLOB_SIZE const and validation

What stays in CLI:

• File reading (fs::read)
• Filename extraction from path
• MIME detection (mime_guess)
• --keyring bail
• Output formatting

Tests to write in core:

• Happy path roundtrip (encrypt+upload mocked, verify record body)
• Rejects oversized blob
• Verifies wrapped key targets owner DID
• Verifies document record structure