Sorry, you're right about using PUT to create a resource at the supplied URL -- but you're still breaking the expectation of idempotence: repeating the same req

Sorry, you're right about using PUT to create a resource at the supplied URL -- but you're still breaking the expectation of idempotence: repeating the same request should have the same result, not 201 the first time and 405 thereafter. If you really want those semantics use POST. If you're really set on using PUT, you could change your semantics a bit so that PUTting the original file again results in 200 OK but attempts replace it with a different file return 409 Conflict or something.