- internal/upload owns chunked-upload domain logic (fingerprint resume,
part tmp+rename, assemble, session sweep) and the shared UniquePath
helper used by both single-file and chunked completion paths
- handlers/uploads.go is now HTTP-only: bind params, call upload.U, map
sentinel errors to the unchanged status/code/message contract
- B16: session sweep moved out of the UploadInit request path onto the
scanner ticker via a Sweeper hook (upload.U satisfies it)
- unit tests for the package without PG/Redis; contract pinned by the
existing handler integration tests (all green)
