files: PUT /t/<path> (expires after 30 days) or /k/<path> (kept) with a bearer token; GET is public