[DO NOT MERGE] 957 xls report upload

- the only bits left before this is mergeable is to do ui cleanup when a file is upload
this and the below POST need accompany tests in `routes_test`