on api file upload

Exposes URI on /api/. Accepts a multipart/form-data POST request and saves the attached file. Also accepts resumable (tus 1.0.0) uploads, so a client on a flaky connection continues where it stopped instead of starting over; the function runs once, when the whole file has arrived. Supports its own rate limit and lock (serialisation) through the pins below.

Startup registration block, not a flow executor: registers a POST /api/{version}/{uri} endpoint that accepts multipart/form-data uploads, saves each file under the entity's temp directory and calls the On Request function with connection, params, query, body and file pins (file entries are {filename, path, type} ready for file_* blocks; JSON-looking form fields are parsed into the body). The same endpoint also takes a resumable tus 1.0.0 upload (a POST with Tus-Resumable and Upload-Length opens a session at /api/v1/_system/upload/{id}; PATCHes append; HEAD reports the offset). The function then runs once, after the last byte, with the same pins a multipart POST would give it, so the blueprint needs no change. The filesize pin caps upload bytes (default 5 MB); the rate_limit and lock pins add per-endpoint throttling and serialization and must be fixed values on the block, not wired chains. A route without any scope is LOCKED with 403 : not public; use *public to expose it. An *ip:<entry> scope admits callers by client address: a CIDR (*ip:203.0.113.0/24), an IP (*ip:203.0.113.3) or a hostname whose A/AAAA records list the allowed addresses (*ip:gateways.example.com, re-resolved hourly; a name that never resolved admits nobody).