feat: persist upload creation metadata

Add the first upload API endpoint from PLAN.md. POST /api/uploads now
validates the requested file name, generates a server-owned upload id, creates
the staging and complete directory layout, and writes durable meta.json before
returning chunk scheduling details to the browser.

Keep filesystem layout knowledge in storage.rs so later chunk upload and
completion work can reuse the same boundary. API handlers translate storage
errors into JSON HTTP responses without leaking layout details into the router.

Document the new modules and UPL_DATA_DIR configuration, and extend TESTS.md
with the automated creation coverage.

Test Plan:
- just check

Refs: PLAN.md milestone 2

src/app.rs

@@ -5,17 +5,29 @@ use std::{
     path::{Path, PathBuf},
 };
 
-use axum::{Router, routing::get};
+use axum::{
+    Router,
+    routing::{get, post},
+};
 use tower_http::services::{ServeDir, ServeFile};
 
+use crate::{api, storage::Storage};
+
 const DEFAULT_BIND_ADDR: &str = "127.0.0.1:3000";
 const STATIC_DIR_ENV: &str = "UPL_STATIC_DIR";
+const DATA_DIR_ENV: &str = "UPL_DATA_DIR";
 const BIND_ENV: &str = "UPL_BIND";
 
 #[derive(Clone, Debug)]
 pub struct AppConfig {
     pub bind_addr: SocketAddr,
     pub static_dir: PathBuf,
+    pub data_dir: PathBuf,
+}
+
+#[derive(Clone, Debug)]
+pub struct AppState {
+    pub storage: Storage,
 }
 
 impl AppConfig {
@@ -29,26 +41,39 @@ impl AppConfig {
             .unwrap_or_else(|_| DEFAULT_BIND_ADDR.to_owned())
             .parse()?;
         let static_dir = env::var_os(STATIC_DIR_ENV).map_or_else(default_static_dir, PathBuf::from);
+        let data_dir = env::var_os(DATA_DIR_ENV).map_or_else(default_data_dir, PathBuf::from);
 
         Ok(Self {
             bind_addr,
             static_dir,
+            data_dir,
         })
     }
 
     #[must_use]
-    pub fn new(bind_addr: SocketAddr, static_dir: impl Into<PathBuf>) -> Self {
+    pub fn new(
+        bind_addr: SocketAddr,
+        static_dir: impl Into<PathBuf>,
+        data_dir: impl Into<PathBuf>,
+    ) -> Self {
         Self {
             bind_addr,
             static_dir: static_dir.into(),
+            data_dir: data_dir.into(),
         }
     }
 }
 
 pub fn build_router(config: &AppConfig) -> Router {
+    let state = AppState {
+        storage: Storage::new(&config.data_dir),
+    };
+
     Router::new()
         .route("/healthz", get(healthz))
+        .route("/api/uploads", post(api::create_upload))
         .fallback_service(static_service(&config.static_dir))
+        .with_state(state)
 }
 
 async fn healthz() -> &'static str {
@@ -62,3 +87,7 @@ fn static_service(static_dir: &Path) -> ServeDir<ServeFile> {
 fn default_static_dir() -> PathBuf {
     PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("static")
 }
+
+fn default_data_dir() -> PathBuf {
+    PathBuf::from(env!("CARGO_MANIFEST_DIR")).join("data")
+}