Add place.stream.media.createUpload XRPC + a tusd-backed /api/upload handler. createUpload is DPoP-authenticated, pre-creates the upload, and returns a URL plus a short-lived HS256 bearer token bound to the upload id; chunk requests skip DPoP and just send the bearer. Storage backend selection: S3 if S3Configured, else filestore under $DataDir/uploads. Multi-node + no-S3 hard-fails at startup since file-backed uploads can't survive a different node serving them. The bearer-token signing key is lazily generated and persisted in the statedb config table on first startup so all nodes in a station agree, same pattern as the lexicon repo key in pkg/atproto/lexicon_repo.go. Completion fires a TaskVODProcess statefuldb task carrying the upload metadata; the processor is a stub that just logs and self-completes. The actual VOD pipeline (probe -> MUXL tracks -> records) follows in a later change. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>