rizzla-drop: PUT /<name.ext> with bearer auth -> temporary public URL (7-day expiry)