Initiate an object upload into the bucket

Initiates an object upload into the bucket, backing the "Upload" actions in the bucket detail header and the object-browser toolbar (uploads target the currently browsed prefix). The backend validates the destination, reserves the upload and returns a short-lived upload session with a presigned PUT URL the browser streams the file to. Once the upload completes, the object appears in the browser and the bucket's counters update. Validation: bucketId must reference an existing, non-deleted bucket in the scope (unknown → 404 NOT_FOUND); key is required and must be a valid, non-empty object key (optionally prefixed by the browsed folder); contentType must be a syntactically valid media type and sizeBytes a positive integer within the per-object size limit (invalid → 422 VALIDATION_FAILED); the subscription's storage quota must accommodate sizeBytes (exceeded → 409 QUOTA_EXCEEDED); a bucket in its deleting workflow rejects new uploads (→ 409 CONFLICT); caller must hold owner|admin|contributor on the scope, otherwise 403 FORBIDDEN. Async & state: Synchronous issuance — returns 200 with the BucketUploadSession; the data transfer itself then happens out-of-band against uploadUrl until expiresAt. When the object lands, a resource.updated SSE frame is emitted (kind storage.bucket, patch {objectCount, sizeBytes, updatedAt}) so open views refresh their counters. Errors: 401 unauthenticated; 403 caller lacks write permission on the scope; 404 unknown scopeId or bucketId; 409 CONFLICT bucket is mid-deletion; 409 CONFLICT details.reason=project_suspended the project's Temp-URL keys are withdrawn while it is suspended; 409 LOCKED the key already exists in a legacy delete-protected bucket (objectLock: true), an overwrite would replace it; 409 QUOTA_EXCEEDED storage quota cannot accommodate the declared size; 422 invalid key, content type or size (an invalid key carries details.reason=object_key_invalid and details.rule one of empty|too_long|control_char|folder|edge_unreachable; the key is the exact object name, never trimmed, at most 1024 UTF-8 bytes, and must not start with / or contain //, a ./.. segment, ; or \ -- the public object-store endpoint refuses such paths); 429 upload-session issuance rate limit exceeded; 500 unexpected backend failure. Signing key: the URL is signed with the account's Temp-URL-Key (slot 1). An existing slot-1 key -- including one the customer set -- is reused unchanged; only an account without one gets a key written, once. Slot 2 and container keys are never written. Idempotency/Concurrency: This operation does not use Idempotency-Key; it may be omitted and a sent one is ignored. Every call issues a new upload session (new uploadId, freshly signed uploadUrl, new expiresAt); nothing is reserved, so a retry simply yields another session for the same key. The presigned uploadUrl is revealed only in this response and never in any read model.