Get a fresh upload URL for a pending document

Issues a new short-lived presigned S3 URL for a document entry whose bytes never arrived, so a failed upload can be retried against the SAME entry rather than creating a duplicate. Use it whenever the original URL has expired or its PUT failed.

PUT the file to uploadUrl with every header in requiredHeaders unchanged, exactly as for the original. 409 if the document has already been uploaded — replacing a stored file means deleting the entry and creating a new one. 404 if the application or document is unknown.