Implement scoped upload invites

Adds a second, narrower credential type alongside UPLOAD_PASSWORD: an
admin (ADMIN_PASSWORD-gated, /admin) can mint time-boxed, use-limited,
independently revocable invite links (?invite=<token>) that skip the
password screen for one-off sharing without handing out the master
password. Invite consumption is an atomic check-and-increment to avoid
a race on single-use invites; admin surface 503s (not boot failure)
when ADMIN_PASSWORD is unset.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -44,6 +44,22 @@ territory for this project family, not a variant of something already built.
 Full design, including why "delete on first byte served" is the wrong
 default, is in [IMPLEMENTATION.md](./IMPLEMENTATION.md).
 
+## Upload access
+
+Uploading is gated by `UPLOAD_PASSWORD` (required — the server refuses to
+start without it), shared by everyone who's allowed to upload.
+
+For granting access to one person for one reason without handing them the
+master password, admins can mint **scoped upload invites**: a link
+(`?invite=<token>`) that skips the password screen, valid for a limited
+number of uses and a limited time, independently revocable. Invite
+management lives at `/admin`, gated by a separate `ADMIN_PASSWORD` — unset,
+the admin surface is disabled entirely (503s) and everything else works as
+usual.
+
 ## Status
 
-Design only. No code yet.
+Implemented: upload/download, encryption, TTL cleanup, password gate, and
+scoped upload invites. See [IMPLEMENTATION.md](./IMPLEMENTATION.md) for the
+deletion-race design and [PROPOSAL-invite-links.md](./PROPOSAL-invite-links.md)
+for the invite feature's design rationale.