feat(upload-api): wire WRITES_DISABLED env var into context

[hannahhoward]

Summary

• Adds a strict-'true' parseWritesDisabled(env) helper to upload-api/utils.js and threads writesDisabled: parseWritesDisabled(process.env) into the context passed to createUcantoServer in ucan-invocation-router.js.
• Together with feat(upload-api): add writesDisabled context flag for halting user writes upload-service#708, setting WRITES_DISABLED=true in this stack's env will short-circuit the eight user-initiated write capabilities (space/blob/{add,remove,replicate}, space/index/add, upload/{add,remove}, store/{add,remove}) with a ServiceUnavailable failure receipt. Reads and receipt-side handlers remain functional.

Deliverables

File	Status	Summary
upload-api/utils.js	Modified	Adds parseWritesDisabled(env): boolean — strict 'true' literal match.
upload-api/functions/ucan-invocation-router.js	Modified	Threads writesDisabled into the createUcantoServer context.
upload-api/test/utils.test.js	New (test)	6 ava cases for parseWritesDisabled: 'true', 'false', '1', empty string, missing — only 'true' returns true.

Dependency

⚠️ Blocked on storacha/upload-service#708 merging and a new @storacha/upload-api version being published + bumped in this repo's catalog. The writesDisabled field on UcantoServerContext is added by that PR. Until the catalog bump:

• This PR's tsc will flag writesDisabled as an unknown property on the context. (Other pre-existing typecheck errors in this repo are unrelated.)
• This PR should remain in draft. After the catalog bump and re-run of pnpm install, the typecheck should clear.

Operational notes

• WRITES_DISABLED is read once at Lambda cold start; flipping requires a redeploy / process restart.
• Default unset → writesDisabled: false → behavior unchanged.
• Disabled invocations emit console.warn from the upload-service handler (visible in CloudWatch).

Test plan

• pnpm exec ava --node-arguments='--experimental-fetch' --timeout=60s 'test/utils.test.js' in upload-api/ — 6/6 passing
• After catalog bump: full pnpm run lint exit 0
• Staging smoke: set WRITES_DISABLED=true in staging env, confirm space/blob/add returns ServiceUnavailable, reads still work

🤖 Generated with Claude Code