files.2a.qa upload bypass — POST /api/files