v2: upload + URL-submit web forms (deferred from v1.0)

[deOliveira-R]

Deferred from Phase 5 by explicit scope cut — the CLI `grimoire ingest` covers Rodrigo's own workflow. Revisit when a non-CLI user (web-only) needs to add items.

Scope

• `POST /upload` — multipart file upload, runs through `ingest_file`.
• `POST /submit-url` — posts URL to the bundled `translation-server` Docker sidecar, round-trips to `ingest_from_metadata`.
• Web UI surfaces: "+ Add" button in the top bar, modal with two tabs ("Upload file" / "From URL").
• CSRF protection once we're accepting writes from the browser.

Acceptance

• `POST /upload` accepts PDF / EPUB up to 100 MB, runs full ingest pipeline, returns the new item id (or the merged target).
• `POST /submit-url` calls the translation-server, pre-fills metadata, CAS-stores the fetched file.
• CSRF token in the form; rejected without it.
• Progress feedback while the file uploads / translation-server runs.