feat: add upload_asset tool (16th tool) for image/asset upload

- POST /api/asset/upload with multipart field name file[] (files/files[]
  are silently swallowed by the reverse proxy on this deployment, per
  SiYuan v3.8.2 kernel/model/upload.go)
- audit: target notebook requires W permission
- code:0 + empty succMap is treated as a hard error (the exact silent
  failure that forced a previous session to fall back to raw HTTP)
- client: extract callRaw, allow FormData body, 120s timeout for uploads
- self-check: src/upload.test.ts (stubbed fetch, no HTTP)
- live-tested against siyuan.ipao.vip; probe asset cleaned up

package.json

@@ -5,7 +5,7 @@
   "dependencies": {
     "typebox": "1.3.7"
   },
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "SiYuan Note extension for pi coding agent — HTTP API wrapper with notebook-level RWD permission auditing",
   "keywords": [
     "pi-package",
@@ -37,7 +37,7 @@
   ],
   "author": "rogee",
   "scripts": {
-    "check": "node --experimental-strip-types --no-warnings src/audit.test.ts"
+    "check": "node --experimental-strip-types --no-warnings src/audit.test.ts && node --experimental-strip-types --no-warnings src/upload.test.ts"
   },
   "prepublishOnly": "node --experimental-strip-types --no-warnings src/audit.test.ts"
 }