Optional CV upload during signup (PRD-B Phase 2/4).

Accepts either the director onboarding token or an invited-member token, stores the raw document content-addressed, and records the sha on the person's own row, server-side (B-5.7). The sha is never round-tripped through the client: credentials is a free-form dict, so a client-set cvAssetSha would be an unvalidated reference into the shared asset store — which also holds de-identified clinical images.

Parsing happens AFTER the response is sent (B-1.1): pdfminer/pypdf and especially the OCR fallback are tens of CPU-seconds, and nothing about the CV needs to be parsed before the form returns.