fix: rename OSS_DIRECT_UPLOAD_EXPRESS_SECRET to OSS_DIRECT_UPLOAD_EXPIRE_SECONDS

Root cause of upload endpoint 500 errors:
- config.py defined OSS_DIRECT_UPLOAD_EXPRESS_SECRET (wrong name)
- upload.py accessed settings.OSS_DIRECT_UPLOAD_EXPIRE_SECONDS (correct name)
- AttributeError on every call to prepare_direct_upload → 500

This fixes both /api/v1/upload/prepare-direct-upload and any other
upload endpoints that reference the expire seconds config.

apps/api/app/config.py

@@ -87,7 +87,7 @@ class Settings(BaseSettings):
         default=2000,
         validation_alias=AliasChoices("OSS_DIRECT_UPLOAD_MAX_MB", "MAX_UPLOAD_SIZE_MB"),
     )
-    OSS_DIRECT_UPLOAD_EXPRESS_SECRET: int = 900
+    OSS_DIRECT_UPLOAD_EXPIRE_SECONDS: int = 900
 
     LOG_LEVEL: str = "INFO"
     CORS_ORIGINS_RAW: str = (