A file arriving on an upload request. The adapter builds this from the
multipart body; bytes is the whole file held in memory (fine for the admin
use-case — logos, avatars, small docs — a streaming path can come later).
Store an uploaded file, returning a ready ApiResponse. The adapter calls
this after parsing multipart; auth is the caller’s responsibility (the
resource checks Update before invoking).