Review and file a returned vendor W-9

Files a PDF/image that arrived on the vendor's tracked W-9 request. Records the original protected attachment, request, tax year, reviewer, and received date; then marks the vendor W-9 received and resolves the request. Outbound or unrelated attachments cannot be filed. This route and the W-9 request route are the only writers of a vendor's w9Status: ordinary vendor create/update cannot mark a W-9 received. The stored tax year is collection provenance, not an annual expiry. Requires manage:contacts and an idempotency-key header.