Delete Upload

Delete an upload and its associated file. Permanently removes the upload record and schedules the stored file for deletion. The record is removed first; the file is cleaned up asynchronously after the response so storage removal only happens after a successful commit. If the upload was previously confirmed against a workspace-scoped resource, the consumed storage bytes are released back to the workspace quota, keeping the workspace storage counter accurate. Callers can delete uploads in any state (`pending` or `uploaded`). Deleting a `pending` upload (e.g. after an expired presigned URL) is the correct way to clean up an abandoned upload attempt. Dual-auth: Bearer JWT or API key (scope `uploads:write`).