feat: wire the front controller and harden userToken path

src/Http/Handlers/GetAssets.php

@@ -27,9 +27,13 @@ final class GetAssets
 
         if ($kind === 'uploads') {
             $userToken = $params['userToken'] ?? '';
+            if (!preg_match('/^[a-f0-9]{32,}$/', $userToken)) {
+                return Response::html(404, '<h1>Not found</h1>');
+            }
+
             $requestToken = $request->cookies['__uploads_token'] ?? '';
 
-            if ($userToken === '' || $userToken !== $requestToken) {
+            if ($userToken !== $requestToken) {
                 return Response::html(404, '<h1>Not found</h1>');
             }