goblossom v1
endpoints:
  GET    /<sha256>[.ext]    download blob
  HEAD   /<sha256>          check blob exists
  HEAD   /upload            preflight check (Nostr auth)
  PUT    /upload            upload blob (Nostr auth)
  DELETE /<sha256>          delete blob (Nostr auth)
  GET    /list/<pubkey>     list blobs (public)
  GET    /health            liveness probe

auth: Authorization: Nostr <base64 event>
limits: per-key max upload size