feat: persist upload creation metadata

Add the first upload API endpoint from PLAN.md. POST /api/uploads now
validates the requested file name, generates a server-owned upload id, creates
the staging and complete directory layout, and writes durable meta.json before
returning chunk scheduling details to the browser.

Keep filesystem layout knowledge in storage.rs so later chunk upload and
completion work can reuse the same boundary. API handlers translate storage
errors into JSON HTTP responses without leaking layout details into the router.

Document the new modules and UPL_DATA_DIR configuration, and extend TESTS.md
with the automated creation coverage.

Test Plan:
- just check

Refs: PLAN.md milestone 2

README.md

@@ -16,7 +16,10 @@ assembly are tracked in `PLAN.md` and will be added in later coherent slices.
 upl
   Rust server
     src/main.rs        binary entrypoint and listener setup
-    src/app.rs         Axum router, health endpoint, static file service
+    src/app.rs         Axum router, shared state, static file service
+    src/api.rs         HTTP handlers and API error responses
+    src/model.rs       JSON request, response, and metadata shapes
+    src/storage.rs     local filesystem layout and durable metadata writes
     src/lib.rs         library surface used by integration tests
   Browser UI
     static/index.html  upload tool markup
@@ -32,6 +35,8 @@ upl
 - `UPL_BIND` sets the listen address. It defaults to `127.0.0.1:3000`.
 - `UPL_STATIC_DIR` sets the static asset directory. It defaults to `static/`
   inside this repository.
+- `UPL_DATA_DIR` sets the upload data directory. It defaults to `data/` inside
+  this repository.
 
 ## Common Commands