POST/GET /api/asset-category-attribute-defs, auth-gated, thin route mirroring src/app/api/asset-categories/route.ts.