The P1 epic: the upload route reads its own body after `require_human` resolves, so an anonymous caller can no longer make the server spool 500 MiB before the auth check runs. Three deep-review fix rounds on top of it.