fix: align upload-asset URL contract end-to-end

- ImageUploadService::store() now returns /assets/uploads/<token>/<file>
  so the URL the upload handler emits matches the new GET route.
- public/index.php registers a dedicated GET /assets/uploads/{userToken}/{filename}
  route; the legacy /assets/{kind}/{filename} is kept as a fallback.
- GetAssets reads the upload token from $request->server['__uploads_token']
  (the front controller threads it that way) instead of the cookies bag.
- Adds GetAssets unit tests for the upload-token happy path and a
  token-mismatch 404, plus a FullFlowTest step that uploads and re-fetches
  the asset through the front controller.

src/Application/ImageUploadService.php

@@ -33,6 +33,6 @@ final class ImageUploadService
         // file itself to 0600 in case the server's umask is permissive.
         chmod($destination, 0600);
 
-        return '/assets/' . $this->userToken . '/' . $filename;
+        return '/assets/uploads/' . $this->userToken . '/' . $filename;
     }
 }

src/Http/Handlers/GetAssets.php

@@ -31,7 +31,7 @@ final class GetAssets
                 return Response::html(404, '<h1>Not found</h1>');
             }
 
-            $requestToken = $request->cookies['__uploads_token'] ?? '';
+            $requestToken = (string) ($request->server['__uploads_token'] ?? '');
 
             if ($userToken !== $requestToken) {
                 return Response::html(404, '<h1>Not found</h1>');