Upload a document

Uploads one file (multipart field file; one per request) into a folder (folder_id, default top level), optionally linking it to a client (client_id). Allowed types: PDF; PNG, JPEG, WebP, GIF; XLSX, XLS, ODS, CSV; DOCX, DOC, ODT, RTF; PPTX, ODP; TXT, Markdown, XML, JSON; ZIP; the extension and the file's bytes must agree, else 422 validation_failed (fields.file). Larger than DOCUMENTS_MAX_UPLOAD_MB (default 100): 413 payload_too_large. Names are cut to 255 characters and lose path parts. Duplicate check: the SHA-256 of the actual bytes is compared inside the workspace with live documents (client files included) and receipts on non-deleted expenses; identical bytes answer 409 duplicate_file whatever the name, folder or on_conflict, with details {existing_id, existing_name, resource: document or receipt, expense_id?} (only when the caller may read that resource, else a generic message). Trashed documents and deleted expenses do not block; other workspaces never match. A same-named live file in the folder is a name conflict, resolved by on_conflict (fail: 409 name_taken with details {existing_id, suggestion}; keep_both; replace: the old file goes to the Trash, 409 retained if it is a business record); on_conflict applies only to different content. Repeating a successful upload answers 409 duplicate_file.