- rl_upload.dspy: use b64media2url to convert base64/local path to
public URL before calling vendor API
- docs/api_downapp.md:
- Clarify dapi Bearer Token auth flow (dapi middleware -> get_user/get_userorgid)
- Add base64 upload example for rl_upload
- Clarify rl_status URL is a temporary signed download link (12h),
asset is permanently stored on volcengine, permanent ref is vendor_asset_id
- Update overview with auth, upload, and key management sections
- New table rl_app_user for application tracking
- APIs: rl_apply, rl_verify, rl_upload, rl_status, rl_check_app_status
- Ops CRUD for managing applications and keys
- Multi-vendor support reserved via vendor field
