feat(images): caption / alt text per image, end-to-end

[bigin]

Summary

Brings 1.x image-title functional parity onto the 2.0 stack across all
three layers, on top of the iManager files.title column.

Editor — UploadEndpoint:

• New PATCH method: body {fileId, title, tokenName, tokenValue} →
  200 {"status":"ok","title":"..."} on success, 404 unknown id, 400
  missing fileId. Uses the same parseBody() helper as DELETE so it
  works regardless of whether the client posts the body as
  form-urlencoded PATCH or query string.
• handle() routes PATCH alongside POST and DELETE.

Editor — PagesModule:

• renderUploadedFileRow emits an inline title input + "save title"
  button per file with data-* attributes the JS handler reads.
• renderLegacyImageRow takes an index and emits an input named
  legacy_image_titles[<index>] so titles persist with the page save.
  Migrated 1.x entries stay in Item.data.images on purpose (Plan §9:
  no destructive migration).
• saveAction merges any posted legacy_image_titles[i] back into
  data.images[i].title before re-saving the item.

Editor — filepond-init.js:

• New click handler on .image-list__title-save: PATCHes the upload
  endpoint, surfaces "saving…", "saved" (auto-clears after 1.5s), or
  "failed" on the row's status span.

Frontend — BasicTheme::headlineImage:

• Modern attachments now propagate $file->title instead of the
  hardcoded ''. Hero/figure templates already render INFO through
  Sanitizer::markdown so captions support inline markdown (links,
  emphasis), matching the 1.x path.

Test plan

• POST upload → 200; fileId
• PATCH title=Captured… → 200 {"status":"ok"}; DB has the title
• Edit form refetch → title input prefilled with saved value;
  legacy input present (legacy_image_titles[0])
• POST save-page with legacy_image_titles[0]=… → 302;
  data.images[0].title updated in DB
• Frontend (cache flushed) → caption rendered in hero
• Browser: type in caption + save title button → status flashes
  "saved"; reload frontend → caption visible