The /attachments/{brainId}/{thoughtId}/file can be used to upload files. But everything uploaded through that endpoint is visible as an attachment.
Looking at a note with an embedded .png, I saw those are stored in a .data subfolder - so we need a new endpoint (or an enhanced version of the one I mentioned) to allow saving files there.