Create a pre-signed upload URL for a new file.

Flow:

1. Call this endpoint with fileName, contentType, and uploadInfo ({ "documentType": "proof", "tourId": "..." }). The response contains a pre-signed url (valid for 15 minutes) and the file's permanent storage key.
2. Upload the file with an HTTP PUT to url, sending the raw file bytes as the body with Content-Type set to the same contentType from step 1. Any S3-compatible upload method or plain HTTP client works; in Postman, choose the "binary" body type.
3. Attach the file to an entity using the returned key — for example as a proof document on a tour stop.

fileName must not contain directory separators (/). The key is namespaced per tenant and tour: {tenant}/{tourId}/proofs/{fileName}.

Warning: uploading to a key that already exists silently overwrites the existing file. Include a random component in the file name (e.g. a UUID) to avoid collisions.