feat(mcp): issue upload tickets for ingest

Add short-lived single-use HTTP upload tickets that authenticated MCP clients can request before uploading files to /mcp-ingest/uploads. This lets remote agents use curl without needing to read or expose the main MCP bearer token, avoiding oversized base64 tool arguments for larger files.

The upload endpoint now accepts either the normal bearer token or X-Obsidian-Wiki-Upload-Token. Ticket defaults can carry project, doc_type_hint, note, start_job, and file-count limits while uploads still stage outside the vault.

Validation: python3 -m unittest discover -v; python3 -m py_compile obsidian_wiki/mcp_ingest.py obsidian_wiki/mcp_server.py tests/test_mcp_ingest.py tests/test_mcp_server_remote.py; git diff --check

.env.example

@@ -57,8 +57,10 @@ OBSIDIAN_MCP_ENABLED_TOOLS=file-assets
 # the first upload; set run_smoke_test=true to verify OpenCode can load the
 # project wiki-ingest skill without editing files.
 # Preferred remote file upload path: POST multipart/form-data to
-# /mcp-ingest/uploads with the same Authorization bearer token as /mcp. Agents
-# can also call `get_ingest_upload_instructions` for exact fields/examples.
+# /mcp-ingest/uploads. Agents that cannot read the main MCP bearer token should
+# call `create_ingest_upload_ticket` first and send the returned
+# X-Obsidian-Wiki-Upload-Token header. `get_ingest_upload_instructions` returns
+# exact fields/examples.
 # Keep this runtime root outside OBSIDIAN_VAULT_PATH; uploads are staging inputs,
 # and wiki-ingest decides how sources are archived into the vault.
 # Prefer OBSIDIAN_MCP_ENABLED_TOOLS=file-assets,ingest for new configs. This