feat: add the TechLog asset multipart upload transport

Wires the whole Asset capability into the running application: the
multipart upload transport (the contract runtime can only express JSON
bodies), a single composition-root-owned CSRF provider shared between
the platform's credential collaborator (18 JSON operations) and the
upload transport (1 multipart operation), and Studio/StudioShell
exposure of the Asset gateway alongside the existing document gateway.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/helpers/studio-install-context.ts

@@ -1,9 +1,17 @@
+import { createCsrfTokenProvider } from "../../src/features/tech-log/adapters/http/studio-session-csrf.ts";
 import type { TechLogInstallContext } from "../../src/features/tech-log/adapters/create-tech-log-feature-input.ts";
 
 /**
  * The install context the existing Studio test suite composes against. It
  * always selects the mock adapter, so `contractOperations` is a throwing stub
  * — `createTechLogFeatureInstalledInput` never reads it on the MOCK branch.
+ *
+ * `createStudioAssetGateway` is unconditional (Task 7), so `apiBaseUrl`,
+ * `requestTimeoutMs` and `csrf` must still be well-formed even here: building
+ * the gateway constructs the upload transport eagerly. No existing test
+ * exercises the asset gateway's operations, so `contractOperations` and
+ * `csrf` stay throwing stubs — the same "never actually used" contract as
+ * before.
  */
 export const MOCK_STUDIO_INSTALL_CONTEXT: TechLogInstallContext = Object.freeze({
   studioSource: "MOCK",
@@ -12,4 +20,11 @@ export const MOCK_STUDIO_INSTALL_CONTEXT: TechLogInstallContext = Object.freeze(
       throw new Error("contract executor is not used by the mock Studio gateway");
     },
   }),
+  apiBaseUrl: "http://mock-studio.test/",
+  requestTimeoutMs: 10_000,
+  csrf: createCsrfTokenProvider({
+    async execute() {
+      throw new Error("CSRF provider is not used by the mock Studio gateway");
+    },
+  }),
 });