Guard / API
foldkit-guard/media
foldkit-guard/media: foldkit-media's UploadPolicy decided by a guard
set. Who is asking comes from the application's resolver, the one its
Remote server is given (AuthServer.resolver from foldkit-auth/server has
the shape), read from the request's headers alone, so the upload route
still reads no byte before the policy has answered. Each route is decided by
principal guards, since no row exists yet; a route not named is refused.