Upload one file for a hosted workflow capture session

Authenticates with client credentials — no bearer token required.

Forwards the request to identity-kyc's internal file route, which stores the image against the case's field: the proof-of-address capture block (`field_id: proof_of_address`) or a programme-defined upload field (its `f_` id). A thin passthrough — which fields take a file is identity-kyc's business rule, answered with 400 `field_not_uploadable`. No OAuth bearer token: `capture_session_token` in the body is the entire authorization, verified downstream. `image_base64` is standard base64 of at most 11 000 000 characters (about 8 MB decoded); a larger one is refused with 413 `file_too_large` before anything is forwarded. `content_type` is `image/jpeg`, `image/png` or `image/webp` (otherwise 400 `unsupported_file_type`). Served by the vision host — the hosted capture widget's own surface, not the primary API host (see this operation's `servers` entry), same as documentScan/detailsSubmit. Rate-limited per-source-IP and per-session-token (both fixed 60s windows); a 429 carries a `Retry-After` header.