Register an uploaded document

**Step 2 of the two-step presigned document upload.** Call this *after* you have PUT the file bytes to the `uploadUrl` from `POST /projects/{id}/documents/upload-url`. Pass the `uploadRef` from step 1 (or the `storagePath` + `kind`) plus the `title` (and `audience` for `kind: info`). Verifies the object actually landed in storage (and re-checks its real size/type against the ≤25 MB, PDF/JPG/PNG cap), then creates the document record. The new document then appears in `GET /documents?projectId={id}`. Reading document metadata stays on the read-only `/documents` collection; this project-scoped route is the upload (write) side. Admin or the project's Site Manager; blocked on read-only/archived projects.

curl -X POST "https://example.com/projects/497f6eca-6276-4993-bfeb-53cbbbba6f08/documents" \  -H "Content-Type: application/json" \  -d '{    "title": "string"  }'

{  "id": "497f6eca-6276-4993-bfeb-53cbbbba6f08",  "projectId": "5a8591dd-4039-49df-9202-96385ba3eff8",  "title": "string",  "storagePath": "string",  "uploadedAt": "2019-08-24T14:15:22Z",  "uploadedByName": "string",  "audience": "all_crew",  "kind": "ohs"}

{  "error": {    "code": "unauthorized",    "message": "Missing or invalid API key."  }}

{  "error": {    "code": "read_only",    "message": "Your subscription is inactive. This action is read-only."  }}

{  "error": {    "code": "not_found",    "message": "Not found."  }}

{  "error": {    "code": "validation",    "message": "One or more inputs are invalid.",    "fields": {      "fieldName": "A message explaining what's wrong with this field."    }  }}