ydm-files — GCX FTP ingestion API
All endpoints require Bearer token (Authorization header, X-Api-Token header, or ?token= query).

Endpoints:
  GET  /health
  POST /sync                            — pull new XMLs from FTP
  POST /sync?path=/deliveries/in        — limit to subdir
  POST /sync?dry=1                      — list only, no DB writes
  GET  /files                           — list (?path,&filename,&since,&limit,&offset,&include_content)
  GET  /files/:id                       — single file metadata + content
  GET  /files/:id/raw                   — raw XML download
  GET  /stats                           — totals + recent runs

FTP file manager (web UI at /ui):
  GET  /ftp/list?path=                  — directory listing
  GET  /ftp/download?path=              — download a file
  POST /ftp/upload?path=&name=          — raw body = file bytes
  POST /ftp/delete   {path,type}        — file, or empty dir (type=dir)
  POST /ftp/rename   {from,to}          — rename / move
  POST /ftp/mkdir    {path}