OK, I found the issue. Turns out if you send the status from the server to the browser BEFORE you read all of the data sent to you by the browser, the lwIP stack (part of my server project on an ST Micro) sets the RST flag. The browser then ignores the status. This includes status of 200 (meaning the upload succeeded) or any other status such as 400 (Bad).

So, even though I find the error early on - such as the user sent a file of the wrong file type - I have to receive all of the file (through the Content Length) before I respond...

Works now!