Issues a presigned S3 upload URL for a file. When encrypted is true, a per-upload RSA public key is also returned (SPKI DER, base64) for the client to encrypt to; workspaceId is required in that case. The matching private key is wrapped under the workspace data key and stored against the upload, never returned.