#1046 Upload links follow-ups (#1042): cancel wakes the waiting workflow, /info stops returning internal ids, local download URL served

EARS SPEC: - When a person cancels an upload request, the waiting workflow shall resume within 5 s with a result that says cancelled (not wait until timeout_seconds). - GET /api/v1/uploads/<token>/info shall not return tenant_id, workflow_run_id or event_name to the link holder. - If storage is local, then the download URL returned for an uploaded file shall point at a route that serves it with the caller's permission, or no URL shall be returned. Found by the #1042 agent 2026-10-22; out of #1042 scope.