Validates the metadata and returns a presigned S3 PUT URL. The API never
receives the bytes — the browser PUTs them straight to S3, sending the same
(lowercased) Content-Type that was signed.

The S3 key is derived server-side from the authenticated client
(settings/client_<clientId>/logo), is never returned, and is persisted at
presign time inside this same POST — there is no separate confirm step.
The key is deterministic, so a re-upload overwrites the previous logo and
GET /settings/logo keeps returning a valid download URL.

Accepted types: image/jpeg, image/png, image/gif, image/webp,
image/svg+xml; the fileName extension must match the declared
fileType.