fix: align upload-asset URL contract end-to-end

- ImageUploadService::store() now returns /assets/uploads/<token>/<file>
  so the URL the upload handler emits matches the new GET route.
- public/index.php registers a dedicated GET /assets/uploads/{userToken}/{filename}
  route; the legacy /assets/{kind}/{filename} is kept as a fallback.
- GetAssets reads the upload token from $request->server['__uploads_token']
  (the front controller threads it that way) instead of the cookies bag.
- Adds GetAssets unit tests for the upload-token happy path and a
  token-mismatch 404, plus a FullFlowTest step that uploads and re-fetches
  the asset through the front controller.

tests/Unit/Application/ImageUploadServiceTest.php

@@ -38,7 +38,7 @@ final class ImageUploadServiceTest extends TestCase
 
         $url = $service->store($tmp, 'image/png');
 
-        self::assertStringStartsWith('/assets/user-token-1/', $url);
+        self::assertStringStartsWith('/assets/uploads/user-token-1/', $url);
         self::assertStringEndsWith('.png', $url);
 
         $stored = $this->tmpDir . '/user-token-1/' . basename($url);