Server encryption

The server encrypts the uploaded file with a database-held file master key protected by the Docker secret. Downloads decrypt automatically. Plaintext exists during upload/finalization.

Token-free endpoint. This upload is a single request; interrupted uploads must be restarted.