Store an asset

Persist a file to Runtype asset storage and return its descriptor (id, servable URL, content type, size). Provide EXACTLY ONE of `content` (base64-encoded inline bytes) or `url` (a source the server downloads with SSRF protection and a 25 MB cap). Public assets get a permanent public URL; private assets get a 1-hour HMAC-signed URL. Tenant identity is taken from the authenticated caller — identity fields in the body are rejected. Also reachable at POST /v1/runtime/assets (the runtime-family contract consumed by `@runtypelabs/runtime`'s HostedAssetStore).