Legacy GET /i/:uploadId/:secret unchanged. Lookup new uploads by access token hash; decrypt with token from path.