Users need to upload files up to two gigabytes. How would you design that end to end?

Do not proxy the bytes through your API. Have the client request a presigned upload URL, upload directly to object storage with multipart upload for large files, and then notify your service, which verifies the object and records metadata. Validate content type and size limits at the policy level, scan asynchronously before the file is usable, and generate short lived signed URLs for downloads rather than making objects public.

The first decision is that the file never goes through my API, because two gigabytes through a request handler ties up a worker, costs bandwidth twice and breaks the moment a connection drops. So the client asks my service for a presigned upload URL, scoped tightly to one key, one content type and a short expiry, and uploads directly to object storage. For files this size I use multipart upload, which gives me resumability, since a failed part is retried instead of the whole file. When the upload completes the client calls back, or better, storage emits an event, and my service verifies the object exists and matches the expected size before writing metadata. The file starts in a pending state and only becomes usable after asynchronous processing: scanning, checking the real content type from the bytes rather than trusting the extension, and generating any thumbnails. Downloads go through a short lived signed URL issued after an authorization check, never a public bucket, which is where a surprising number of data leaks come from.