Adds authenticated resumable raw-object uploads to hosted PostgreSQL raw sync. Scoped upload tokens can start or resume an upload, read its exact offset, and append bounded chunks. Finalization independently verifies length and SHA-256 before tenant-scoped immutable custody; retries are idempotent, and offset or checksum conflicts return the authoritative resume offset.
Upload sessions are durable in PostgreSQL and staged in a private restart-safe spool with exact-offset fencing, crash-tail truncation, and bounded cleanup of expired or orphaned state. The runtime privilege probe now includes the upload table's exact DML requirements.
Raw custody remains lazily opened under its dedicated `raw-sync` repository, preserving ordinary `pg serve` startup and repository ownership behavior from #1473. Device enrollment UX, laptop watcher behavior, quotas, S3 hosting, and downstream processing remain outside this slice.
Refs #1352
Co-authored-by: Rusty Shackleford <salmonumbrella@users.noreply.github.com>
Rusty Shackleford
86a7682c3f