feat(web): upload routes -- form, multipart intake, honest status (ADR-033)

GET/POST /uploads, GET /uploads/{id}, GET /uploads/{id}/status, mounted only
when an Uploader is wired. The multipart body is streamed to Intake, never
buffered. Rejections are synchronous: 422 (video, too long, unreadable) or 413
with the user-facing message and no row. Another user's id is a 404 that does
not leak the title. Unfinished states poll; done/failed render without
hx-trigger so nothing polls forever (ADR-025). A done transcript names the
endpoint that served it.

handlers.go, uploads.go and the templ pair are one commit: the App fields and
Store methods are what make the handlers compile.

Mutation-checked: dropping the 413 mapping, the not-found mapping, or letting
a done card poll each turn a test red.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/web/handlers.go

@@ -13,6 +13,7 @@ import (
 
 	"git.d-ma.be/mathias/tapir/internal/adapters/store"
 	"git.d-ma.be/mathias/tapir/internal/domain"
+	"git.d-ma.be/mathias/tapir/internal/uploads"
 )
 
 // Store is the read/write surface the web handlers depend on — a narrow port over
@@ -53,6 +54,12 @@ type Store interface {
 	// the most recent discovery pass, shown on the account page as a warning.
 	ListChannelErrors(ctx context.Context, userID string) ([]store.ChannelError, error)
 
+	// Uploaded-audio transcripts (ADR-033): the caller's own PRIVATE uploads,
+	// stored apart from the shared public captions. Both are user-scoped; a
+	// non-owner's id is ErrUploadNotFound.
+	GetUpload(ctx context.Context, userID, id string) (*domain.UploadedTranscript, error)
+	ListUploads(ctx context.Context, userID string) ([]domain.UploadedTranscript, error)
+
 	// SetTranscriptStatus clears or updates a video's transcript backoff state.
 	// Used by handleRetryNow to clear rate_limited_at before immediate processing.
 	SetTranscriptStatus(ctx context.Context, userID, videoID, status string) error
@@ -100,6 +107,12 @@ type App struct {
 	// summary view shows no "dig deeper" affordance. It holds no caption-fetch
 	// dependency, so an enabled chat cannot reach YouTube or the rate gate.
 	Chat Chatter
+	// Uploads, when non-nil, accepts audio recordings for private transcription
+	// (ADR-033). Nil = the /uploads routes are not mounted. UploadLimits are the
+	// same limits the Uploader enforces, shown on the form so they are stated up
+	// front rather than discovered by failing.
+	Uploads      Uploader
+	UploadLimits uploads.Limits
 	// Processing tracks in-flight immediate summarizations so the status endpoint
 	// shows the animation until the summary lands. The zero value is ready to use.
 	Processing ProcessingSet
@@ -166,6 +179,14 @@ func (a *App) Router() http.Handler {
 		app.HandleFunc("GET /v/{videoId}/chat", a.handleChat)
 		app.HandleFunc("POST /v/{videoId}/chat", a.handleChatMessage)
 	}
+	// Audio upload → private transcript (ADR-033). Mounted only when an Uploader is
+	// wired; every handler is user-scoped, so another user's upload is a 404.
+	if a.Uploads != nil {
+		app.HandleFunc("GET /uploads", a.handleUploadsPage)
+		app.HandleFunc("POST /uploads", a.handleUploadPost)
+		app.HandleFunc("GET /uploads/{id}", a.handleUploadDetail)
+		app.HandleFunc("GET /uploads/{id}/status", a.handleUploadStatus)
+	}
 	app.HandleFunc("GET /register", a.handleRegisterForm)
 	app.HandleFunc("POST /register", a.handleRegister)