phase B (2/2): CSV upload endpoint + drag-drop UI

Completes Phase B. The full alternative-onboarding flow is now end-to-end:
drop a T212 pie CSV → parser → InstrumentMap resolver → PortfolioSnapshot
+ Position rows, all without ever asking the user for broker credentials.

- persist_pie() in app/services/csv_import.py: takes a ParsedPie, resolves
  each Slice via InstrumentMap, writes Portfolio + Snapshot + Position
  rows. Unmapped slices are still persisted using their CSV values and
  surfaced in the response for the UI to warn about.
- POST /api/portfolios/upload: multipart endpoint accepting CSV file +
  optional portfolio_name + currency. 2 MiB cap. Returns import summary.
- /upload page with drag-drop dropzone, file input fallback, and inline
  result panel showing invested/value/result + unmapped-slice warnings.
- New "Import" link in the header nav.

Verified end-to-end against the real T212 export: all 13 positions land
with correct T212 tickers (incl. FPp_EQ for the Paris TotalEnergies
listing the heuristic resolver picks), zero unmapped slices, totals
reconcile to the penny.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

app/templates/base.html

@@ -42,9 +42,10 @@
   <header class="app-header">
     <div class="brand">Cassandra</div>
     <nav>
-      <a href="/"     class="{% if request.url.path == '/' %}active{% endif %}">Dashboard</a>
-      <a href="/news" class="{% if request.url.path == '/news' %}active{% endif %}">News</a>
-      <a href="/log"  class="{% if request.url.path.startswith('/log') %}active{% endif %}">Log</a>
+      <a href="/"       class="{% if request.url.path == '/' %}active{% endif %}">Dashboard</a>
+      <a href="/news"   class="{% if request.url.path == '/news' %}active{% endif %}">News</a>
+      <a href="/log"    class="{% if request.url.path.startswith('/log') %}active{% endif %}">Log</a>
+      <a href="/upload" class="{% if request.url.path == '/upload' %}active{% endif %}">Import</a>
     </nav>
     <div class="header-right">
       <button class="theme-toggle" type="button" aria-label="Toggle theme"