mdbox — markdown upload & share API (no frontend, links only)

  POST   https://md.foragent.cc/                 create   -> { slug, url, editToken }
  GET    https://md.foragent.cc/<slug>           raw markdown (text/markdown)
  GET    https://md.foragent.cc/<slug>?json      metadata as JSON
  PUT    https://md.foragent.cc/<slug>           replace body      (needs token)
  DELETE https://md.foragent.cc/<slug>           delete document    (needs token)

Upload (body is the markdown itself):
  curl -H 'content-type: text/markdown' --data-binary @note.md https://md.foragent.cc/
  curl -X POST https://md.foragent.cc/ --data-urlencode 'ttl=30d' --data-urlencode 'markdown@note.md'
  curl --data-binary @note.md https://md.foragent.cc/?ttl=forever&slug=my-notes

Options on create:
  ttl     1h 6h 1d 7d 2w 30d 90d 365d ... forever   (default 7d)
  slug    custom vanity path, 4-32 chars [a-z0-9-]
  title   override the auto-derived title

Token:
  The editToken returned on create is the only credential that can
  update or delete a doc (it is stored hashed). Send it as
  'x-token: <t>', 'Authorization: Bearer <t>', or '?token=<t>'.
  Lose it and the doc is read-only forever — but still readable by link.

Anyone holding the link can read the doc. Unguessable slugs are the only
thing protecting it: treat https://md.foragent.cc/<slug> as a secret URL.