#1042 #931 T4: remove duplicate /storage/<ref> routes; make human upload links work end to end

EARS SPEC: - The API shall not serve DELETE /api/v1/storage/<ref> or GET /api/v1/storage/<ref>/url; /storage/files/* keeps serving with its current permissions. - When tools.storage creates an upload request, the link it returns shall be built from the public base URL ([api] public_base_url, https://highway.rodmena.app in prod), never from the internal http://api:7822. - When a person opens the upload link and uploads a file within its expiry, the waiting workflow shall resume with the stored file reference; an expired, used or cancelled token shall be refused with a clear error and the workflow shall not resume. - POST /api/v1/uploads/<token>/cancel shall require proof of possession of the token's cancel secret (or the link holder's token), never be callable by anyone who only guesses a path. - The nginx route for /u/ is host config owned by infra-manager: the exact location block shall be handed to them over AgentBus; Highway does not edit host nginx. Owner decision 2026-10-22: fix uploads, do not drop the feature. Parent #931.