v0.2.0 — Direct upload, S3 optional

What's changed
Fottly no longer requires an S3 bucket to transform an image.
New: POST /transform/:transforms — send an image as multipart/form-data
and get the transformed image straight back in the response. Same transform
syntax and same pipeline as /t/..., including AI background removal.
Requires the API key.
S3 is now optional. With no S3_BUCKET set, the server starts and serves
direct uploads; the bucket-backed routes (/t/..., /files/...) answer 503.
Uploads are capped by MAX_UPLOAD_SIZE_MB (25 MB default) and refused with a
413 while still arriving, so an oversized file is never buffered past the limit.
Optional watermark file field, since wm_ refers to a bucket key.
Direct uploads are not cached and do not fall back to passthrough: an undecodable
file returns 400 instead of being echoed back. Animated GIFs and PDFs still need
the bucket-backed route.

curl -X POST -H "Authorization: Bearer $API_KEY" \
  -F "file=@photo.jpg" \
  "http://localhost:3000/transform/w_400,h_300,f_webp" -o result.webp

Closes #8.