Web: $_FILES population and move_uploaded_file subset

[PurHur]

Problem

lib/Web/Superglobals.php declares _FILES in NAMES but does not populate it. Contact forms with <input type="file"> need $_FILES['field']['name'], ['tmp_name'], ['error'], etc.

Multipart parsing (#52) is prerequisite; this issue covers the PHP superglobal shape and minimal upload API.

Goal

Populate $_FILES from parsed multipart bodies and support a minimal move_uploaded_file() for VM (JIT optional later).

Tasks

• Extend multipart parser (Web: multipart/form-data and application/json POST bodies #52) to build nested array structure per field
• Superglobals::populateFiles() writing into VM HashTable
• Runtime init for AOT sg_FILES global (Web: Runtime-populated superglobals for JIT and AOT (per-request $_GET/$_POST) #49)
• move_uploaded_file($from, $to) — VM implementation; security: restrict paths under upload dir
• PHPT: single file upload field, assert $_FILES keys
• Document max upload size (ties to Security: Request body size limits and header sanitization in CGI driver #77)

Acceptance criteria

HTML form with enctype="multipart/form-data" and one file field produces usable $_FILES in VM + CGI driver (#50).

Related

• Web: multipart/form-data and application/json POST bodies #52 multipart/form-data
• Security: Request body size limits and header sanitization in CGI driver #77 Security limits
• Reference app: examples/003-MiniWebApp (router, templates, forms) #67 Reference app (optional contact upload)