Store a one-time secret

Requires permission: IT

Stores a payload the client has already encrypted, and returns a short link to it. The API receives ciphertext, KDF parameters and an auth key it only ever hashes — never the passphrase and never the plaintext, so it cannot read what it is holding.