Converts PKCS#7/CMS files of any size to modern JOSE (JWE/JWS) detached format.

This is a format conversion (PKCS#7 container → JOSE container), not an algorithm conversion.
Classical algorithms (RSA, ECDSA, AES) are preserved or upgraded (CBC→GCM).

Supported conversions:

• SignedData (1 signer) → JWS detached JSON
• EnvelopedData (1 recipient) → JWE detached multipart
• SignedAndEnvelopedData (1 signer + 1 recipient) → JWE(JWS) detached multipart

Response format varies by PKCS#7 type:

SignedData returns application/octet-stream:

{"protected":"eyJhbGc...","signature":"dGVz..."}

EnvelopedData returns multipart/mixed:

------ankatech-<UUID>
Content-Type: application/jose+json

{"protected":"...","recipients":[...],"iv":"..."}

------ankatech-<UUID>
Content-Type: application/octet-stream

<binary ciphertext stream>
------ankatech-<UUID>--

Important:

• No size limit (processes files of any size)
• Response does NOT include metadata (signers, recipients, algorithm details)
• For metadata: Use POST /api/migration/stream/analyze-pkcs7 first
• Output is directly compatible with POST /api/v3/crypto/stream/reencrypt or /resign

Prerequisites: Import signer/recipient keys via POST /api/migration/pkcs12

Input: multipart/form-data with 'metadata' (JSON) and 'file' (binary PKCS#7)