fix: align upload-asset URL contract end-to-end

- ImageUploadService::store() now returns /assets/uploads/<token>/<file>
  so the URL the upload handler emits matches the new GET route.
- public/index.php registers a dedicated GET /assets/uploads/{userToken}/{filename}
  route; the legacy /assets/{kind}/{filename} is kept as a fallback.
- GetAssets reads the upload token from $request->server['__uploads_token']
  (the front controller threads it that way) instead of the cookies bag.
- Adds GetAssets unit tests for the upload-token happy path and a
  token-mismatch 404, plus a FullFlowTest step that uploads and re-fetches
  the asset through the front controller.

src/Application/ImageUploadService.php

@@ -33,6 +33,6 @@ final class ImageUploadService
         // file itself to 0600 in case the server's umask is permissive.
         chmod($destination, 0600);
 
-        return '/assets/' . $this->userToken . '/' . $filename;
+        return '/assets/uploads/' . $this->userToken . '/' . $filename;
     }
 }