To prevent abuse, I'm using Cloudflare Turnstile to challenge bot access. Since the server validates the token from the browser, curl doesn't work—you'll have to use the web UI to upload. It's the simplest way I could keep the spam away for now.