rendezvous — drop it, pick it up, gone.

We have met here, at this arbitrary point in spacetime.

  POST   /v1/drop          drop something (covenant bearer or sck_ key; `user` scope)
                           {"url": "https://…"}                      → GET 302s to it
                           {"body": "…", "content_type": "text/plain"} → GET serves it
                           + "ttl_secs" (default 1h, capped) and "reads" (default 1 =
                           burn after reading; 0 = unlimited until expiry)
  GET    /d/{id}           pick it up — anonymous, one read consumed
  GET    /v1/drop/{id}     bookkeeping without consuming (owner or admin)
  DELETE /v1/drop/{id}     retract (owner or admin)
  GET    /v1/drops         my drops: handle, kind, size, age, TTL left, reads left,
                           pick-ups; never the id or the contents (signed in)
  DELETE /v1/drops/{handle} revoke one of my drops by its handle (signed in, owner)
  GET    /health           service · version · build
  GET    /cp/metrics       role-scoped KPIs

Tiny blobs only. Whether a restart forgets drops and links depends on where
this instance keeps them: memory forgets, SQLite keeps. A burned drop is gone either way.