Digests only, never files
POST /api/v1/proof/anchor accepts JSON containing exactly one 64-character SHA-256 digest. The public page hashes files locally in the browser.
fetch('/api/v1/proof/anchor', {
method: 'POST',
headers: {'Content-Type': 'application/json'},
body: JSON.stringify({sha256: '…'})
})