NU-012 nuron-api: Laravel REST facade and upload entry point #26

Part of #30.

nuron-api (Laravel): the REST facade and the only thing nuron-web talks to.

Build

Endpoints: upload, review queue (list/fetch/save/approve), merge-candidate confirm, query + SSE
relay. Owns schema nuron_api.

• Upload is a second ingestion entry point: single request, size-capped at 25 MiB of raw
  file bytes — upload_max_filesize=25M (PHP's M ini shorthand is already binary, matching
  Laravel's max:25600 KB exactly, so PHP itself rejects an oversized file before
  parsing/buffering it), post_max_size=26M (1 MiB headroom above that for multipart boundaries
  and other form fields). Setting both PHP limits equal to 26M would let a 25–26 MiB file be
  fully parsed before Laravel's validation ever ran — the ini cap has to match the
  real limit to reject at the PHP layer, not after. No mtime-stability rule — bytes arrive
  complete. Multipart/resumable deferred.
• RustFS object write completes before the documents row is inserted — same ordering as the
  directory path (NU-005), so a crash mid-upload leaves an unreferenced object, never a dangling
  row.
• Same content hash as the directory path, so an uploaded duplicate is one record and one object.
• Query is proxied straight through with SSE relayed to the caller.

Boundary rules

• nuron-api must not read nuron_ai tables. Enforced by DB role in NU-001 Scaffold: compose stack, Postgres schema, env template #16. All pipeline state is
  reached through nuron-ai's API.
• nuron-api and nuron-web bind to host loopback only (127.0.0.1) — tightened from a plain
  host binding since this slice has no auth; nuron-ai, Postgres, Neo4j and RustFS are internal.
  PRD §5.4 says nuron-api is internal-only, which contradicts three other sections — this is the
  adversarial review's F-1 and its own recommended fix.
• The pipeline stays in nuron-ai. A review queue is a suspended pipeline, not a CRUD entity:
  a file is mid-flight, a stage blocks, a human unblocks it, it resumes. Laravel is excellent at
  request/response business logic and is not what should hold a DAG.

Note

No PHP on the dev machine — this is Docker-only locally.

Closes

A12 (upload half).