proper asset creation/deletion, also raw file view in admin as well

spec.mobile.md

@@ -74,28 +74,28 @@ Payload:
 - Method: `PUT`
 - Path: `/api/v1/mobile/media/sync`
 - Required header: `x-device-id`
+- Content-Type: `multipart/form-data`
 
-Payload:
+Upload contract:
 
-```json
-{
-  "assets": [
-    {
-      "externalMediaId": "media-1",
-      "fileId": "01JNE3Q1S3KQX9Y7G2J8G7R0A8",
-      "mimeType": "image/jpeg",
-      "filename": "IMG_1234.jpg",
-      "capturedAt": "2026-03-01T10:05:00.000Z",
-      "sizeBytes": 1350021,
-      "hash": "sha256-...",
-      "metadata": {
-        "width": 3024,
-        "height": 4032
-      }
-    }
-  ]
-}
-```
+- One request uploads one raw media file.
+- Multipart field `file` is required (binary).
+- Optional multipart metadata fields:
+  - `externalMediaId`
+  - `mimeType`
+  - `filename`
+  - `capturedAt` (ISO date string)
+  - `sizeBytes` (number)
+  - `hash`
+  - `metadata` (JSON object string)
+- Optional metadata headers (alternative to multipart fields):
+  - `x-media-external-id`
+  - `x-media-mime-type`
+  - `x-media-filename`
+  - `x-media-captured-at`
+  - `x-media-size-bytes`
+  - `x-media-hash`
+  - `x-media-metadata` (JSON object string)
 
 ## Response Contract
 
@@ -144,8 +144,9 @@ Failure:
   - Dedup key #1: `(deviceId, externalMessageId)` when provided.
   - Dedup key #2 fallback: `(deviceId, dedupHash)` where dedup hash is SHA-256 of `(deviceId + sentAt + sender + body)`.
 - Media:
+  - Raw file is uploaded first and persisted in `file`.
+  - Then one `mobile_media_asset` row is created referencing uploaded `fileId`.
   - Dedup key: `(deviceId, externalMediaId)` when provided.
-  - `fileId` in `mobile_media_asset` is unique.
 
 ## Operator Checklist