fix: align upload-asset URL contract end-to-end

- ImageUploadService::store() now returns /assets/uploads/<token>/<file>
  so the URL the upload handler emits matches the new GET route.
- public/index.php registers a dedicated GET /assets/uploads/{userToken}/{filename}
  route; the legacy /assets/{kind}/{filename} is kept as a fallback.
- GetAssets reads the upload token from $request->server['__uploads_token']
  (the front controller threads it that way) instead of the cookies bag.
- Adds GetAssets unit tests for the upload-token happy path and a
  token-mismatch 404, plus a FullFlowTest step that uploads and re-fetches
  the asset through the front controller.

public/index.php

@@ -106,6 +106,13 @@ $postUpload = static fn (Request $r, array $p): Response => (new PostImageUpload
 $getAssets = static function (Request $r, array $p) use ($placeholderDir, $uploadsRoot): Response {
     return (new GetAssets($placeholderDir, $uploadsRoot))->handle($r, $p);
 };
+$getUploadedAsset = static function (Request $r, array $p) use ($placeholderDir, $uploadsRoot): Response {
+    $handler = new GetAssets($placeholderDir, $uploadsRoot);
+    return $handler->handle(
+        $r,
+        ['kind' => 'uploads', 'userToken' => $p['userToken'] ?? '', 'filename' => $p['filename'] ?? ''],
+    );
+};
 
 $router = new Router();
 $router->add('GET', '/', $homePage);
@@ -115,6 +122,7 @@ $router->add('GET', '/scenarios/{id}/edit/battlefield', $getBattlefield);
 $router->add('POST', '/scenarios/{id}/edit/battlefield', $postBattlefield);
 $router->add('POST', '/scenarios/{id}/start', $postStart);
 $router->add('POST', '/assets/upload', $postUpload);
+$router->add('GET', '/assets/uploads/{userToken}/{filename}', $getUploadedAsset);
 $router->add('GET', '/assets/{kind}/{filename}', $getAssets);
 
 // 8. Dispatch and emit.