POST /api/admin/upload: hand-rolled multipart parser (no deps installed
in this project), real magic-byte sniffing (rejects extension-spoofed
files), 8MB cap, and EXIF/GPS stripping via a sips bmp round-trip
(macOS-native, no dependency — sips's direct jpeg->jpeg re-encode alone
does NOT strip EXIF, only the bmp intermediate does). GET /uploads/*
serves the result with a path-traversal guard.
forwardToH3Assets() is the T7/T8 hook for pushing a saved upload to H3
Console's own POST /v1/assets (found in the S1-S4 spike) — not covered
by the automated suite since it needs a live network call, same
treatment as the spike scripts.