feat: persist upload creation metadata

Add the first upload API endpoint from PLAN.md. POST /api/uploads now
validates the requested file name, generates a server-owned upload id, creates
the staging and complete directory layout, and writes durable meta.json before
returning chunk scheduling details to the browser.

Keep filesystem layout knowledge in storage.rs so later chunk upload and
completion work can reuse the same boundary. API handlers translate storage
errors into JSON HTTP responses without leaking layout details into the router.

Document the new modules and UPL_DATA_DIR configuration, and extend TESTS.md
with the automated creation coverage.

Test Plan:
- just check

Refs: PLAN.md milestone 2

TESTS.md

@@ -10,6 +10,8 @@ Keep this file as the reusable verification checklist while implementing
   - Current coverage:
     - `GET /` serves the static browser page.
     - `GET /healthz` reports `ok`.
+    - `POST /api/uploads` creates `meta.json` and chunk directories.
+    - `POST /api/uploads` rejects an empty file name.
 
 ## Manual