Sync Headless Assets

Resolves a content-addressed asset manifest for a code-first paywall: returns the hosted URL for every asset and a short-lived presigned upload for the ones not yet stored. Runs as the assets step of superwall push/publish before the version push. Identical content is never uploaded twice. Requires paywalls:write scope.