fix: align upload-asset URL contract end-to-end

- ImageUploadService::store() now returns /assets/uploads/<token>/<file>
  so the URL the upload handler emits matches the new GET route.
- public/index.php registers a dedicated GET /assets/uploads/{userToken}/{filename}
  route; the legacy /assets/{kind}/{filename} is kept as a fallback.
- GetAssets reads the upload token from $request->server['__uploads_token']
  (the front controller threads it that way) instead of the cookies bag.
- Adds GetAssets unit tests for the upload-token happy path and a
  token-mismatch 404, plus a FullFlowTest step that uploads and re-fetches
  the asset through the front controller.

src/Http/Handlers/GetAssets.php

@@ -31,7 +31,7 @@ final class GetAssets
                 return Response::html(404, '<h1>Not found</h1>');
             }
 
-            $requestToken = $request->cookies['__uploads_token'] ?? '';
+            $requestToken = (string) ($request->server['__uploads_token'] ?? '');
 
             if ($userToken !== $requestToken) {
                 return Response::html(404, '<h1>Not found</h1>');