ydm-files — GCX FTP ingestion API
All endpoints require Bearer token (Authorization header, X-Api-Token header, or ?token= query).

Endpoints:
  GET  /health
  POST /sync                            — pull new XMLs from FTP
  POST /sync?path=/deliveries/in        — limit to subdir
  POST /sync?dry=1                      — list only, no DB writes
  GET  /files                           — list (?path,&filename,&since,&limit,&offset,&include_content)
  GET  /files/:id                       — single file metadata + content
  GET  /files/:id/raw                   — raw XML download
  GET  /stats                           — totals + recent runs