Import an encrypted asset (exact bytes)

Imports the raw request body as an encrypted vault asset — a pasted or dropped image stored bit-for-bit (no transcoding, no metadata stripping), sealed as a multi-chunk blob under the asset-subkey. The asset id is the sha256:<hex> of the exact plaintext, so identical bytes dedup to one blob; the on-disk filename is an unrelated random UUID. The request's Content-Type becomes the asset's recorded MIME type. 413 past the per-asset ceiling (512 MiB at the service layer; the server's global transport cap binds first over real HTTP).