feat(uploads): resilient multipart upload retries

[zfarrell]

A single part exhausting its inner retries used to abort the entire multipart upload, discarding every part already done. This adds an outer round loop that re-sweeps only the failed parts (at decaying concurrency, with backoff) while keeping completed parts' ETags, plus a part-size-scaled per-part PUT timeout (capped at an operational ceiling) so a silently stalled connection fails fast instead of hanging the whole transfer.

[claude]

Solid, well-tested resilience work. The outer re-sweep loop preserves completed parts' ETags, the terminal-vs-transient split is conservative in the right direction (network-ish stays retryable), and the per-part timeout cleanly bounds a silently stalled connection without touching the legitimately-unbounded single-PUT path. Test coverage is strong: reproduce/fix pair, terminal fast-fail, concurrency cap, and an integration test that recovers a transient 500. Two non-blocking nits left inline.

[claude]

Reviewed the resilient multipart retry changes. The outer round loop, per-part timeout scaling, per-part minting, and parse_etag validation are correct and well-covered by both unit and integration tests. Prior nits (mint request volume, MAX_MINT_BATCH removal) are documented in the CHANGELOG. LGTM.