[Security][P1] Protect upload resources and session revocation

[knzeng-e]

Outcome

Public upload capacity is bounded by authenticated artist authority, and logout remains meaningful after an API process restart.

Scope

• Require short-lived, single-use upload authorizations bound to artist address, chain, upload purpose, and byte budget.
• Enforce per-artist and global byte/concurrency quotas.
• Validate media from received bytes rather than trusting multipart MIME declarations.
• Clean up quota reservations and outbound uploads after rejection or interruption.
• Replace process-lifetime-only logout semantics with an explicit restart-safe session policy compatible with the single-instance API topology.
• Preserve EIP-191 and Product sr25519 session identities; keep Free listening and guest room entry unauthenticated.
• Document configuration, persistence, outage behavior, and rollback.

Acceptance

• Cover unauthorized, exhausted quota, spoofed media type, interrupted upload, valid artist, expired authorization, and replayed authorization.
• After logout and process restart, the old token is rejected and a fresh login succeeds.
• Enforce and document the single-instance API limit until shared quota/revocation storage exists.

Local contract: docs/backlog/implementation/W02-upload-session-boundaries.md
Branch: feat/upload-session-boundaries
Target: dev