feat(16.2-01): translatable plugin field types, untouched skip, writes, list values and uploads

- translatable types lift, store and hydrate through the ML path
  (isMLField); Decode and Load run per locale and notices carry the locale
- on update a value equal to the served value (Load of the stored host
  value or exact translation) is neither decoded nor written
- FieldWrite, FieldWritesFromContext and WithFieldWrites expose what a save
  writes to the Form hooks
- list columns may use a plugin alias and show the type's ListValue
- POST .../{id}/fields/{field}/upload hands the file to the type's Upload
  (guard, X-Requested-With, permissions, field context, record scope, body
  cap); OpenAPI, route inventories, README and docs updated

modules/cabana/security_coverage_test.go

@@ -89,6 +89,7 @@ var phase09Routes = []adminRoute{
 	{key: "DELETE /{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}"},
 	{key: "GET /{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}/download"},
 	{key: "GET /{vendor}/{plugin}/{controller}/{id}/files/{field}/{file}/thumb"},
+	{key: "POST /{vendor}/{plugin}/{controller}/{id}/fields/{field}/upload"},
 	{key: "GET /assets/{vendor}/{plugin}/{file...}", public: true, spa: true},
 	{key: "GET ", public: true, spa: true},
 	{key: "GET /{path...}", public: true, spa: true},
@@ -301,6 +302,7 @@ func phase09ProtectedCalls() []phase09Call {
 		{"record-action", (*service).recordAction},
 		{"widget-action", (*service).widgetAction},
 		{"toolbar-action", (*service).toolbarAction},
+		{"field-upload", (*service).fieldUpload},
 		{"partial", (*service).partial},
 		{"show", (*service).show},
 		{"update", (*service).update},