Secure file upload

Signed upload, then R2.

The browser never receives R2 credentials. The Worker issues an HMAC grant, then streams the file to the franchise bucket.