Fix upload proxy safety checks

[gauravyad86]

Fixes #162

This PR fixes a security gap in the upload proxy.

What changed

• added strict upload target validation (HTTPS + S3 endpoint patterns)
• added signed short-lived upload token support
• reject invalid or unsafe target metadata with HTTP 400
• kept backward compatibility while still validating fallback target input
• added a small verification script: npm run verify:upload-proxy

Why

Previously, upload target metadata could be influenced by client-submitted data. This could allow unsafe server-side forwarding behavior in exposed/self-hosted setups.

Validation

• npm run verify:upload-proxy passes
• live route behavior checked:
  • invalid target is blocked
  • valid signed token path is accepted and forwarded upstream