Save the response body to a file: >> ./out.json, >>! ./out.json and apic run --output #33

Why

REST Client and JetBrains write a response to disk with >> ./file (create) and >>! ./file (overwrite) after the request. apic strips those lines with a warning (internal/httpfile/parse.go:260-292). Downloading a report, saving a fixture for a later < file body, or keeping a binary response are all impossible today, and response bodies are Go strings so binary is not even safe.

What

### Export
# @name export-csv
GET {{baseUrl}}/reports/daily.csv

>>! ./fixtures/daily.csv

Acceptance criteria:

• >> path writes the raw response body to path (relative to the .http file, confined to the project root) and fails if the file exists; >>! path overwrites. Directories are created. File mode 0600 when the response came from a request whose headers or query used a secret source, else 0644.
• Response bodies become []byte end to end; the JSON view for selectors, --json and the UI is derived from the bytes. Binary responses print a size and content type instead of garbage in run output.
• apic run --output <file> does the same for one run without editing the file.
• --json adds "saved_to": "fixtures/daily.csv"; the UI response tab says where the body went.
• apic validate reports a path outside the project as an error.

Where

• internal/httpfile/parse.go (splitHandlerBlocks 260-292), ast.go
• internal/runner/runner.go (readBody/response handling around 552), body.go
• internal/cli/run.go, internal/output/render.go

Docs

docs/format.md (Structure table row replaces the "skipped" note), docs/cli.md (run flag and JSON field), docs/cookbook.md ("Download a file" recipe).

Tests

Parser cases for both forms; runner test writing a binary body and comparing bytes; refusal of an existing file without !; path-escape refusal; --json field.