chore(proxy): temporary token-gated file upload page (/up)

Lets the user send large files (tested 30MB) from a phone browser when the
chat upload limit blocks them. GET /up?t=<token> serves a minimal form;
POST streams via busboy to /home/lucas/uploads with a sanitized, timestamped
filename and a 60MB cap. Token lives in proxy/.env (UPLOAD_TOKEN, gitignored).

Constraint: token-gated and size-capped; filename sanitized against path traversal. Temporary utility — remove the route + uploaded files once the transfer is done.
Confidence: high
Scope-risk: local
Reversibility: trivial
Directive: After receiving the file, delete /up route and clear /home/lucas/uploads.
Tested: local GET/POST, wrong-token 403, 30MB upload through the public Caddy domain (HTTP 200, full bytes saved); test files removed.
Not-tested: concurrent uploads (files:1 limit anyway).
Related: proxy/src/routes/upload.ts

🐙 Autopus <noreply@autopus.co>