Import-from-URL was opt-in via the `allow_url_import` claim, but no
minting helper exposed it — each used a fixed whitelist and silently
dropped the six import claims, so the feature was unreachable through
the documented adapter APIs (only a hand-built raw JWT worked).

- core: fluxfiles_token/byob/mixed gain an $import array param
  (fluxfiles_apply_import_claims forwards the claims; core sanitizes
  on decode).
- laravel: FluxFilesManager::applyTenantOverrides() passes them through.
- wordpress: generateToken now applies per-tenant overrides (it also
  previously dropped ai_auto_tag/rate/variants); new
  `fluxfiles_token_overrides` filter enables import for the built-in
  shortcode/media-button/REST flow without a custom caller.
- node: createToken/createByobToken accept allowUrlImport, maxImportMb,
  importUrlAllowlist, importPath, importRateLimit, importConcurrency.

Tests: core round-trip (token + byob), laravel/wordpress smokes, WP
filter hook, node parity. Docs: "Import from URL" how-to in root +
laravel/wordpress/node READMEs.

Adapters now forward MB-named claims, so bump their core floor to
^0.2.16 (verified by the adapter-core-floor guard).

Release: core-v0.2.17, laravel-v0.2.6, wordpress-v0.2.5,
@fluxfiles/node 0.1.3.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>