Starts an upload. Returns a presigned POST valid for 15 minutes — the browser posts a
multipart/form-data request straight to S3 and the binary never goes through the Lambda.

It is a POST, not a PUT: only the presigned POST policy carries content-length-range, and
without it the 5 MB ceiling would be a promise from the client in a bucket that, by design,
never deletes. S3 itself rejects an upload that is larger or that carries another
Content-Type.

The asset is registered as PENDING; call confirm after the upload succeeds.

The resulting publicUrl is public and permanent: anyone with the link can read it.