Incoming files are matched against what is already stored, keyed on the
KOReader hash and the file size. Bulk uploads skip and report them, deliberate
creates are refused with a 409, the consume directory parks them aside, and
allow_duplicates overrides all three.
Also: books whose metadata generates a path another book already owns are moved
aside, so a forced copy cannot overwrite the original's files.