Upload and confirm files for a supported preparation type

Direct API option only. Permission: card.holder.preparation. multipart/form-data: type=holder, id=steps[].id, plus the attachment keys from requirements. Each attachment is optional here; final submit enforces conditional requirements. Returns fileId and metadata, not public file URLs. Next: include fileId values in the complete values snapshot sent to /cards/preparation/submit.