feat(assets): CSV import of the asset inventory (#861)

[alex-dembele]

Closes #861

Stacked on #859 (#755), which is itself stacked on #855 (#792). The base is the #755 branch; merge #855, then #859, then this one. GitHub will retarget it to master.

A team can now load its asset inventory from a spreadsheet instead of typing assets one at a time. The risk file from #755 can then name those assets in its assets column.

• POST /assets/import, behind assets:create + capAssets, tenant from the session only.
• Columns: name (required), type, criticality (LOW/MEDIUM/HIGH/CRITICAL, or FAIBLE/MOYENNE/ÉLEVÉE/CRITIQUE; MEDIUM when empty), owner. Headers nom / criticité are accepted. Typed category/attributes stay out of scope (feat(assets): CSV import of the asset inventory #861 AC 2).
• All-or-nothing in one transaction through CreateAssetUseCase. Errors carry line/column/code/params/message, the same contract as fix(risks): CSV import of risks and assets fails silently #755.
• A name already in the tenant's inventory, or repeated in the file, is refused, so re-importing a file never doubles the inventory. Another tenant's names don't count.
• The plan cap is checked against the whole file (402 limit_reached). Imported assets carry source=IMPORT.
• UI: /assets/import on the shared CsvImportPage from fix(risks): working, all-or-nothing CSV import of risks (#755) #859, an Import button on the inventory, and every string in the FR/EN catalogue.

Verification

go build ./...                                   ok
go test ./... -count=1                           79 packages ok, 0 FAIL
npx tsc -b --noEmit                              ok
npx eslint <changed files>                       ok
npx vitest run                                   103 files, 953 tests passed

Tests: TestImportAssets_{Success,NotFound,Unauthorized,Validation_OneBadRowImportsNothing,ExistingNameIsRefused_OnlyInSameTenant,WriteFailureRollsBackEverything,HeaderAndFileErrors,FrenchSpreadsheetExport,OverCapacityWritesNothing} and TestAssetImportHTTP_{Success,Validation_NothingPersisted,Unauthorized,NotFound_NoFile,RowsLandOnlyInCallersTenant} (real SQLite transaction).

Live (Postgres 18 + Vite, throwaway, French UI):

• Inventory → Importer opens /assets/import.
• Bad file → 422: « urgent » n'est pas une criticité (line 3), « printer » figure déjà ligne 3 (line 4). Nothing persisted.
• French Excel export (;, nom, criticité, CRITIQUE/faible) → 200, 3 assets, source=IMPORT, criticalities CRITICAL/LOW/HIGH.
• Same file again → 422, « Un actif … existe déjà » × 3.
• Then a risk file naming those assets → scores 9.0 (critical asset), 1.5 (low), 3.0 (none).

Honest remainders

• Typed category and attributes are not importable; they are set in the inventory afterwards.
• The stack's merge order matters: fix(risk): create and update store the Score Engine's score, asset criticality included (#792) #855 → fix(risks): working, all-or-nothing CSV import of risks (#755) #859 → this PR.