POST /api/v3/admin/file/ returns 405 when uploading files via File Manager UI (local filesystem backend)

### Describe the bug

Uploading any file via the Admin UI File Manager (`/if/admin/#/files`) fails with HTTP 405.
The upload button is present and functional in the UI, but the underlying API call is rejected.

Actual behaviour:
`POST /api/v3/admin/file/` returns **HTTP 405 Method Not Allowed** with `Allow: GET, HEAD, OPTIONS`.
This happens from both the browser UI and direct API calls (curl, Python requests), authenticated via session cookie or API token.
`OPTIONS /api/v3/admin/file/` reports `POST` as allowed, but actual POST requests are rejected.
`GET /api/v3/admin/file/?manageable_only=true&usage=media` works correctly (returns empty list).

### How to reproduce

1. Install Authentik using the official Docker Compose method (no S3/storage backend configured)
2. Log in as a superuser
3. Navigate to Admin → File Manager (`/if/admin/#/files`)
4. Click "Upload" and select any file
5. The upload fails immediately

### Expected behavior

File is uploaded and appears in the file list.

### Screenshots

@

### Additional context

## Environment
- **Authentik version:** 2026.2 (ak version: 5.2.11)
- **Install method:** Docker Compose (official compose.yml)
- **Storage backend:** Default (local filesystem, no `AUTHENTIK_STORAGE__MEDIA__BACKEND` set)
- **Reverse proxy:** Nginx (proxying to port 9443)
- **OS:** Linux (Debian)
## Logs
From `authentik-server` container:
{"event": "/api/v3/admin/file/", "method": "POST", "status": 405, "runtime": 17, "user": "akadmin", "auth_via": "session"}
{"event": "/api/v3/admin/file/", "method": "POST", "status": 405, "runtime": 17, "user": "akadmin", "auth_via": "api_token"}
{"event": "/api/v3/admin/file/", "method": "OPTIONS", "status": 200, "runtime": 17} ← OPTIONS says POST is allowed
## Additional notes
- No errors appear in the worker or server container logs beyond the 405 response itself
- The media directory (`/media/public/`) exists and is writable
- This appears to be a disconnect between the DRF ViewSet router registration (which doesn't register `create`) and the OPTIONS response (which advertises POST as allowed)
- Workaround: manually place files in the media directory on the host, but they are not served correctly (404 at `/files/media/public/...` — suggests the internal media path structure may also need review)

### Deployment Method

Docker

### Version

2026.2

### Relevant log output

```shell
{"event": "/api/v3/admin/file/", "method": "POST", "status": 405, "runtime": 17, "user": "akadmin", "auth_via": "session"}
{"event": "/api/v3/admin/file/", "method": "POST", "status": 405, "runtime": 17, "user": "akadmin", "auth_via": "api_token"}
{"event": "/api/v3/admin/file/", "method": "OPTIONS", "status": 200, "runtime": 17} ← OPTIONS says POST is allowed
```