v2.1.0

Smaller changes on top of the v2 rewrite: transcribable slugs, three memory fixes,
and looser rate limits.

What's new since v2.0.0

• Slugs are now 15 characters of Crockford base32 — digits and lowercase letters
  without i, l, o and u — sampled from crypto/rand for 75 bits. Lookups
  normalize what you type: case-insensitive, with i and l read as 1 and o
  as 0, so a slug survives being read aloud or typed on another device.
• The slug alone is the secret. GET /<slug> has always redirected to the full
  path, so the filename was never part of it, despite what the README and code
  comments said. The slug now carries the whole secret.
• Rate limits raised to 12 uploads and 240 other requests per minute. The upload
  limit caps store churn rather than memory, and 6/min made batch uploads from a
  shell loop tedious; at 75 bits the read limit is no longer doing meaningful work
  against slug guessing.
• Three memory fixes from a measured pass: deleting or expiring the newest bucket
  no longer leaves up to 500 MB uncollectable; uploads with a known
  Content-Length read into a right-sized buffer instead of peaking at ~2.4x the
  body; and an oversize Content-Length is rejected before the body is read
  rather than after buffering it.
• Piped (chunked) uploads can still peak near 2 GB, which the README now notes.