Register an uploaded MED evidence file

Step 3 of 3, after the `PUT`. Without it the object stays in storage and never becomes part of the defense: this call is what links the bytes to the dispute. Every upload goes through real type checking, antivirus and sanitization before it counts as evidence — a few seconds. `scanStatus` reports that: `PENDING` while running, `APPROVED` when cleared, `REJECTED` with a `scanReason`. Rejected files do not travel with the defense.