feat(rest): support authenticated Linear asset downloads

[tee8z]

Summary

• allow REST capabilities to fetch absolute asset URLs from configured asset_hosts while keeping auth internal to via
• require --output for allowlisted absolute URLs so binary asset responses are written safely
• document Linear upload fetching, agent/editor PATH setup, and surface asset hosts in config generation, capabilities, and doctor output

Verification

• cargo fmt --check
• RUSTC_WRAPPER= cargo test --locked
• RUSTC_WRAPPER= cargo clippy --locked --all-targets -- -D warnings