Hi Bartosz
Sorry for taking so long to answer - I forgot to subscribe to the thread.
Answering your questions:
1. I did not see any problems with zip files upload - actually, I never bothered renaming them to .bar and it worked perfectly well.
2. Not sure what "audit" storing is - if you refer to ACT_HI_DETAIL table then you have a couple of options there.
First, and this was our initial approach (still used though) was to re-implement SubmitStartFormCmd.execute() in our bespoke RESTful web service to provide validation and data mapping facilities aware of our JSON-serialized forms.
Second, and this is how we're doing it now, is to override ProcessEngineConfiguration's getDefaultBpmnParseHandlers() method and supply our own extension of StartEventParseHandler that would use our custom StartFormHandler instead of hard-coded DefaultStartFormHandler. At this point we're pretty much free to do whatever we want to do - namely, supply our own FormPropertyHandlers based on JSON-serialized form definition. This allowed us to comply with DRY (or DRActivitiDevelopers for that matter) principle and go back to using vanilla /form/form-data web service.
Hope that helps.