TODO: production will use Cloudflare R2 with encryption. This stub does not persist the file anywhere.