Replace batch DTOs with per-mode endpoints, persist ciphertext with file-type checks, and return a hashed delete token for future revocation.