#16 Add PUT /api/upload endpoint for MixBoard cloud uploads

PUT /api/upload
Authorization: Bearer <token>
X-Filename: "05 - Echoes.flac"
Content-Type: audio/flac
Body: raw audio bytes

200 {"status": "imported", "tracks_added": 1, "albums_updated": 1}
400 Bad Request (unsupported format)
401 Unauthorized
413 File too large
503 Upload not configured

curl -X PUT https://music.chad-partners.com/api/upload \
  -H "Authorization: Bearer <token>" \
  -H "Content-Type: audio/flac" \
  -H "X-Filename: test.flac" \
  --data-binary @test.flac

## What New `PUT /api/upload` endpoint that lets MixBoard upload audio files directly to the server. Files land in a designated upload directory, get rescanned immediately (playable right away), and beets enriches them on a cron schedule. ## Changes ### server.lisp - `upload-file` handler: streams request body to disk in 64KB chunks - Atomic write: temp file (`.tmp`) + `rename-file` on success, `delete-file` on error - Byte counting in the read loop enforces 200MB limit (does not trust Content-Length) - `sanitize-filename`: allowlist chars, truncate to 200, strip leading dots/dashes - `parse-media-type`: strips Content-Type parameters before matching - Synchronous rescan with `*rescan-lock*` to avoid racing with background rescanner - Returns `{"status": "imported", "tracks_added": N, "albums_updated": N}` - New constants: `+413+` (file too large), `+503+` (upload not configured) ### config.lisp.example - Added `*upload-dir*` setting - Added upload directory to `*path-url-mappings*` ## Deployment checklist 1. **config.lisp**: Set `*upload-dir*` and add to `*path-url-mappings*` 2. **nginx**: `client_max_body_size 200m;` in server block 3. **Directory**: `mkdir -p /data/upload/mixboard && chown uploader:uploader /data/upload/mixboard` 4. **Cron** (user uploader): `*/5 * * * * beet import --move --quiet /data/upload/mixboard/ && curl -sX POST http://localhost:5000/api/rescan` ## Protocol PUT /api/upload Authorization: Bearer <token> X-Filename: "05 - Echoes.flac" Content-Type: audio/flac Body: raw audio bytes 200 {"status": "imported", "tracks_added": 1, "albums_updated": 1} 400 Bad Request (unsupported format) 401 Unauthorized 413 File too large 503 Upload not configured Accepted formats: audio/mpeg, audio/flac, audio/mp4, audio/x-m4a, audio/wav, audio/aiff, audio/ogg ## Testing curl -X PUT https://music.chad-partners.com/api/upload \ -H "Authorization: Bearer <token>" \ -H "Content-Type: audio/flac" \ -H "X-Filename: test.flac" \ --data-binary @test.flac