Finish a file upload

Returns a short-lived URL to post a file to, and an `upload_id` to commit it with. Use this rather than sending bytes to the API. The direct upload endpoints run as serverless functions, which reject request bodies over 4.5MB before this code sees them; here the file goes straight to storage, so the only ceiling is the 25MB we set — and it is enforced by the upload itself, so an oversized file is refused at the door rather than after it is stored. Nothing is stored until you commit. An upload that is never committed expires on its own and counts against nothing. `template_asset` and `template_docx` belong to one template and need `template_id`. `brand_kit_image` and `brand_kit_font` go to the team's Brand Kit, take no `template_id`, and are shared by every template the team has. A Brand Kit upload **adds; it never replaces** — a filename already in the kit is refused with a 409, because replacing a file changes it for every template already pointing at its key. Replacing or deleting one is a dashboard action. A `brand_kit_font` filename must end `.ttf` or `.otf`; a `.woff`/`.woff2` is refused here, before the file is sent, rather than after it arrives. Post the file as `multipart/form-data` to `upload_url`, sending every name/value in `fields` first and the file last, in a part named `file`. `upload_with` is the complete command, already filled in.