img-host: POST /upload (Authorization: Bearer <token>, form-field 'file') -> public URL