[codex] add control-plane file upload URLs

[winrey]

Summary

Adds the aHand control-plane support needed by Team9 streaming host file transfer.

What changed

• Added POST /api/control/files/upload-url so control-plane callers can request a scoped upload URL for device file writes.
• Scoped generated upload object keys under the authorized device prefix.
• Added SDK helpers and exported types for file upload URL creation.
• Improved SDK abort/error classification for upload-url and body-read error paths.

Why

Team9 scp_host_files writes to aHand devices via a worker-mediated streaming relay. Large binary payloads must not be buffered in Team9 memory, so Team9 requests an upload URL and streams the PUT body directly while committing the resulting object through the existing file operation flow.

Validation

• pnpm --filter @ahandai/sdk test passed.
• cargo test -p ahand-hub --test control_files control_files_401_without_auth_header passed.
• Team9 integration work also verified direct upload-url usage without requiring an unpublished @ahandai/sdk@0.2.1 runtime dependency.

Notes

This branch targets dev. The worktree still has a local unstaged pnpm-lock.yaml install-noise diff; it is intentionally not included in this PR.