fix: reject duplicate completed upload names

A user could select another local file with the same name as one that already
exists in completed storage. The upload would be allowed to start and only hit
an existing-file conflict late in the flow, which made the UI look like the
file was uploadable.

Reject duplicate sanitized names during upload creation so no staging record or
chunk transfer starts for a file that cannot be completed. Keep the completion
path non-replacing as a second guard by promoting through a no-overwrite file
creation path, with a hard-link fast path and copy fallback for custom temp
locations.

The browser now treats the server's duplicate-name conflict as a terminal row:
it disables the action, marks the item visually, and tells the user to rename
the file if they want to upload that copy.

Test Plan:
- just check

Refs: none

README.md

@@ -7,8 +7,8 @@ browser -> nginx -> upl Rust server -> local filesystem
 ```
 
 The server writes upload chunks directly into an inaccessible temp file at
-their final offsets. Once every chunk is present, completion atomically renames
-that temp file into the completed upload directory.
+their final offsets. Once every chunk is present, completion promotes that temp
+file into the completed upload directory without replacing an existing file.
 
 ## Project Structure
 
@@ -19,7 +19,7 @@ upl
     src/app.rs         Axum router, shared state, static file service
     src/api.rs         HTTP handlers and API error responses
     src/model.rs       JSON request, response, and metadata shapes
-    src/storage.rs     local filesystem layout, offset writes, and final rename
+    src/storage.rs     local filesystem layout, offset writes, and final promotion
     src/lib.rs         library surface used by integration tests
   Browser UI
     static/index.html  upload tool markup
@@ -48,8 +48,9 @@ upl
 - `upl --help` prints the full argument help text.
 - The server accepts request bodies up to 64 MiB, which leaves room for the
   planned 16 MiB upload chunks and matches the nginx example in `PLAN.md`.
-- Keep `UPL_TEMP_DIR` on the same filesystem as `<data-dir>/complete` so
-  completion can promote files with an atomic rename.
+- Keep `UPL_TEMP_DIR` on the same filesystem as `<data-dir>/complete` for the
+  cheapest final promotion. Cross-filesystem temp directories still work, but
+  completion falls back to copying into a newly created final file.
 
 ## Common Commands
 
@@ -69,6 +70,11 @@ file uploads at the same time, and each file still uploads up to three chunks
 concurrently. Every selected file keeps its own upload id, progress markers,
 abort controller, retry state, and saved IndexedDB resume record.
 
+If a completed file with the same sanitized name already exists, the server
+rejects the upload before staging begins. The selected row is marked
+unavailable and tells the user to rename the file if they want to upload that
+copy.
+
 ## nginx
 
 Run `upl` on localhost and put nginx in front of it for TLS and access control: