Step 1 of the three-step upload flow. Declares the file you are about to upload and
returns a presigned URL to send the bytes to.

After this call:

1. HTTP PUT the raw file bytes to uploadUrl, with a Content-Type header of
   exactly requiredContentType — the URL is signed for that content type and S3
   rejects anything else. Send no Precursor auth headers on the PUT.
2. Call POST /api/v1/patients/{patientId}/documents/{documentId}/complete to
   validate and file the document. Nothing is visible to anyone until complete
   succeeds.

The upload URL expires at uploadExpiresAt (about an hour). Accepted formats and the
100 MB cap are listed in the API overview; the declared fileName extension decides
the required content type. category, when sent, must be one of Pathology,
Imaging, Immunisation or Other (case-insensitive; defaults to Other); date,
when sent, must be yyyy-MM-dd. Returns 403 documents_locked while the patient's
vault is locked, and 404 when the patient has no booking with you.