QuickSend curl interface

Send:     curl -T FILE http://hyperjump.org
          prints a claim URL, then waits; keep curl running
Receive:  curl -OJ CLAIM_URL
          (-OJ names the file as sent; use "curl -o NAME CLAIM_URL"
          if the file was sent from stdin)

Rules:

- The upload response body is the claim URL and nothing else. On a
  terminal it prints immediately. To script it, read the first line:
  curl -N -T f http://hyperjump.org | head -1
- The sender's curl exits 0 only after the receiver has every byte.
  Any failure (expiry, receiver disconnect, size limit) aborts the
  connection and curl exits non-zero.
- Claim URLs are single-use and expire if unclaimed.
- A busy server refuses with "server at capacity" (HTTP 503) and a
  Retry-After hint. The claim URL stays valid; add --retry and curl
  waits and retries on its own:
  curl --retry 5 -fOJ CLAIM_URL
  A 503 without a Retry-After hint ("transfers are disabled") is not
  worth retrying.
- Scripts should receive with -f (curl -fOJ CLAIM_URL): without it,
  curl saves error responses as if they were the file and exits 0.
  Errors are one-line plaintext; on a terminal, plain curl shows them.
- Not end-to-end encrypted: the server can read the content in
  transit. Nothing is written to disk. For end-to-end encryption use
  the qsend client, or pipe through an authenticated encryption tool:
    age -e -p FILE | curl -T - http://hyperjump.org
  press enter at age's prompt to autogenerate the passphrase (a
  chosen one can be guessed offline from the ciphertext), then share
  the claim URL with the passphrase appended after "#"; curl and
  browsers never send the fragment to the server. Receive:
    curl -f CLAIM_URL | age -d > FILE
  and check the exit status: a failure leaves a partial FILE behind.
  Uploading with -T - keeps the filename out of the request; tar
  first to preserve names. gpg -c works where age is not installed.
- Transfers sent with the qsend client use the same shape and can be
  received with curl alone: the part after "#" is the age passphrase.
    curl -f CLAIM_URL | age -d > FILE           (a stream send)
    curl -f CLAIM_URL | age -d | tar x          (a file or directory send)
  The Content-Disposition filename says which: qsend.age is a stream,
  qsend.tar.age is files.