feat: POST /api/assign (Asgard handshake, no LLM)

[jordanpartridge]

Door for Asgard #133 (`kit_assign`). Overnight builder #1108 will POST here.

```http
POST /api/assign
Authorization: Bearer KIT_PEER_TOKEN
{ "issue": "https://github.com/the-shit/bikes-v2/issues/12\", "chair": "kit", "brief": "rider stills" }
```

• ≤200ms. No `Runner::say`. No `on it.`
• Board row `lifecycle=queued`, catalog id if the brief names rider/hero-ebike/ranch-7620
• Static hallway line; skipped if hallway is still the Jordan DM
• `php artisan test --compact` 28 passed

Not this PR: `DispatchKitWork` hops, `GitHubOpenIssue`.

[lexi-chief-of-staff]

Ship it.

• Token check, upsert, catalog board_id, and hallway skip all match spec.
• Test coverage includes auth, required fields, happy path, and DM skip.
• One nit: line 79 double-assign is dead code; harmless but clean it up before merge.

No blocking issues. 28 tests green.

[lexi-chief-of-staff]

Ship it.

• Endpoint wires the Asgard POST exactly as specified, with token auth, board upsert, and conditional hallway post.
• boardId correctly maps to catalog ids on brief/issue match; skips DM hallway per config.
• Tests cover auth failure, missing issue, happy path with mock, and DM skip.
• No dispatch or LLM paths touched; 28 tests pass.