The response of POST /api/blobs/uploads. The upload id is server-minted and is the
only handle the remaining requests carry — a staged session is not a blob (it has no
hash yet), not a resource, and invisible to every other surface.
{
"upload_id": "f2ef591b-135b-46fa-a604-3d4fda5bfbfb"
}