internaluploader: server + docs

One-way upload server: authentik SSO pairing (QR + app-initiated deep
link), hashed device tokens, streamed sha256-verified uploads into the
metube directory as <sha256>.<ext>.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/tsconfig.test.json

@@ -0,0 +1,13 @@
+{
+  // The tests run under Node's type stripping, which resolves imports by their
+  // real filename — hence the `.ts` extensions in the test sources. The build
+  // tsconfig cannot allow those, so tests get their own noEmit config.
+  // Without this the test files would be the one surface nothing checks.
+  "extends": "./tsconfig.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "allowImportingTsExtensions": true,
+    "rootDir": "."
+  },
+  "include": ["src/**/*.ts", "test/**/*.ts"]
+}