Fix(assets): attached files land in assets/, and uploads are no longer corrupted

[adibhanna]

Both bugs were reported against the Android app, which carries the same bridge code. This app had them identically, so it gets the same fix. Android side: ZenNotes/zennotesandroid#41.

Local vault: the file went to the vault root

importDroppedFile asked for a unique name in '', the vault root, wrote the file there, and hand-built the link as '../'.repeat(depth) + filename, so a note in a folder got ![name](<../name.jpg>). Paste already wrote to assets/, and so did the cloud vault.

Desktop had this exact bug and fixed it in ZenNotes#377; the port here was missed.

Now: assets/, linked by vault-relative path, an image as ![[assets/pic.jpg]].

Self-hosted vault: every upload arrived corrupt

The upload hand-built its multipart body as one string and marked the file part Content-Transfer-Encoding: base64. RFC 7578 dropped that header from multipart/form-data and Go's mime/multipart ignores it, so the server wrote the base64 text to disk as the file's bytes: right name, about a third larger, unreadable by anything.

The bytes must stay base64 to cross the native bridge, since a CapacitorHttp string body is written out as UTF-8 and mangles anything above 0x7F. dataType: 'formData' is the supported route: CapacitorUrlRequest.getRequestDataFromFormData decodes a base64File entry and writes the raw bytes into the part, exactly matching the Android layer. The sibling direct-object upload already used the same mechanism with dataType: 'file'.

Proven against the real Go server

body	stored	begins	matches original
old	638,352 bytes	iVBORw0K (base64 text)	no
new	478,762 bytes	\x89PNG	yes, identical sha256

Notes

• The pure rules move into imported-assets.ts so they can be unit-tested: vault-core cannot be loaded by node --test because it reaches @shared/* through a Vite alias. It re-exports them, so every existing importer is untouched.
• npm run typecheck clean, npm test 25/25, npm run build succeeds.
• The matching desktop and self-hosted-server change is in 2.40.0: the Linux updater installs the right package, and every device links attachments the same way zennotes#699.