Validates the metadata and returns a presigned S3 PUT URL. The API never
receives the file bytes — the caller uploads them directly to S3. OCR
progress is reported back asynchronously over SQS and can be polled with
GET /certificates/files/{id}.

fileName must not contain /, \ or .., and its extension must be one
of .pdf .png .jpg .jpeg .gif .bmp .tiff .tif .heic.