feat: add App API Assets methods + multipart upload

[mike-engel]

Another set of the App API backfill on top of #240 which adds 10 methods plus a multipart/form-data upload path in the request layer.

Method	Endpoint
listAssets	GET /v1/assets
createAsset	POST /v1/assets/files (multipart upload)
getAsset	GET /v1/assets/files/{id}
updateAsset	PUT /v1/assets/files/{id} (204)
deleteAsset	DELETE /v1/assets/files/{id} (204)
listAssetFolders	GET /v1/assets/folders
createAssetFolder	POST /v1/assets/folders
getAssetFolder	GET /v1/assets/folders/{id}
updateAssetFolder	PUT /v1/assets/folders/{id} (204)
deleteAssetFolder	DELETE /v1/assets/folders/{id} (200)

⚠️ The upload is multipart, not base64

The issue assumed the SendEmailRequest.attach base64 approach. Asset creation, however, is multipart/form-data; form field file plus optional name / parent_folder_id form values. The JSON mode that exists there only records metadata for an already-uploaded path; it never carries bytes. So base64-in-JSON would not work.

To support it, the transport gained a small, isolated multipart path:

• CIORequest.postForm(uri, form) + formOptions(...) (lib/request.ts): builds the request with a FormData body and deliberately omits the JSON Content-Type so fetch sets multipart/form-data with the correct boundary; no Content-Length is computed. Retries/redirects reuse the same handler/execute path unchanged (RequestHandlerOptions.body widened to string | FormData | null).
• createAsset builds FormData from a Blob (setting the blob's type when contentType is given, else letting the API derive it from the filename).

Assisted by AI 🤖

---

Note

Medium Risk
Touches the shared HTTP client (RequestHandlerOptions, execute) for FormData, but the multipart path is isolated; main risk is upload MIME handling and regressions on JSON requests.

Overview
Adds Assets coverage to APIClient: list/upload/get/update/delete files and the same CRUD for asset folders (integer ids, page-based listing with optional folder filters).

createAsset posts multipart/form-data via a new postForm / formOptions path on the shared request layer. Request bodies can be FormData; JSON Content-Type and Content-Length are omitted so fetch sets the multipart boundary. The SDK derives MIME types from filename (or explicit contentType / Blob type) so uploads are not sent as application/octet-stream.

Public types (AssetListOptions, CreateAssetInput, etc.), docs/app.md reference, unit tests, request-layer tests, and live integration round-trips are included.

^{Reviewed by Cursor Bugbot for commit 0941010. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 5b26bc7. Configure here.}