feat: persist upload creation metadata

Add the first upload API endpoint from PLAN.md. POST /api/uploads now
validates the requested file name, generates a server-owned upload id, creates
the staging and complete directory layout, and writes durable meta.json before
returning chunk scheduling details to the browser.

Keep filesystem layout knowledge in storage.rs so later chunk upload and
completion work can reuse the same boundary. API handlers translate storage
errors into JSON HTTP responses without leaking layout details into the router.

Document the new modules and UPL_DATA_DIR configuration, and extend TESTS.md
with the automated creation coverage.

Test Plan:
- just check

Refs: PLAN.md milestone 2

src/api.rs

@@ -0,0 +1,65 @@
+use axum::{
+    Json,
+    extract::State,
+    http::StatusCode,
+    response::{IntoResponse, Response},
+};
+use serde::Serialize;
+
+use crate::{
+    app::AppState,
+    model::{CreateUploadRequest, CreateUploadResponse},
+    storage::StorageError,
+};
+
+/// Creates an upload record and persists its metadata before returning.
+///
+/// # Errors
+///
+/// Returns an API error when request validation fails or metadata cannot be
+/// written to storage.
+pub async fn create_upload(
+    State(state): State<AppState>,
+    Json(request): Json<CreateUploadRequest>,
+) -> Result<Json<CreateUploadResponse>, ApiError> {
+    let meta = state.storage.create_upload(request).await?;
+    Ok(Json(meta.create_response()))
+}
+
+#[derive(Debug)]
+pub struct ApiError {
+    status: StatusCode,
+    message: String,
+}
+
+impl IntoResponse for ApiError {
+    fn into_response(self) -> Response {
+        (
+            self.status,
+            Json(ErrorResponse {
+                error: self.message,
+            }),
+        )
+            .into_response()
+    }
+}
+
+impl From<StorageError> for ApiError {
+    fn from(error: StorageError) -> Self {
+        let status = if error.is_invalid_input() {
+            StatusCode::BAD_REQUEST
+        } else {
+            StatusCode::INTERNAL_SERVER_ERROR
+        };
+
+        Self {
+            status,
+            message: error.to_string(),
+        }
+    }
+}
+
+#[derive(Serialize)]
+struct ErrorResponse {
+    error: String,
+}