Drop Pool — big-file inbox (files auto-delete after 7 days).
Auth: Authorization: Bearer <token>

GET    /api/files                 list files (JSON; ?format=text for a table)
GET    /f/<name>                  download (streams, supports Range)
GET    /api/url/<name>?ttl=3600   signed download URL (no auth needed to fetch it)
DELETE /f/<name>                  delete
POST   /api/uploads               start upload {name,size,type,sha256}   (admin)
PUT    /api/uploads/part?key=&upload_id=&part=N   upload one part          (admin)
POST   /api/uploads/complete {key,upload_id,parts:[{part,etag}]}          (admin)
DELETE /api/uploads?key=&upload_id=               abort                    (admin)
POST   /mcp                       MCP (streamable HTTP): list_files, get_download_url, delete_file, create_upload_url