Governed Multi-Backend Upload Routing

Resolve primary, replicate, and anchor backends per tenant on every upload with plan-gated policy and visible partial-failure semantics.