fix(upload): bind sessions to immutable source identity

[bipolarrr]

Summary

• bind each upload session to an immutable SHA256_BLOCK_MANIFEST_V1 source identity
• verify chunk bytes against the persisted manifest before claim or storage mutation
• make identical chunk retries idempotent and reject conflicting content with 409 CONFLICT
• hash large files in a browser Worker and block same-size/different-content resume before the first PUT
• fail closed for legacy incomplete sessions and preserve completed-session idempotency
• add backend/frontend regressions, PostgreSQL coverage, and Chromium Playwright E2E

Verification

• npm exec -w apps/api -- vitest run --exclude '**/*.postgres.test.ts' --exclude '**/*.garage.postgres.test.ts' — 1007 passed
• web lint/typecheck and full Vitest suite — 115 passed
• npm run test:e2e:d3 with Chromium — 3 passed
• npm run test:integration — passed, including PostgreSQL, Garage, smoke, and integration E2E
• independent adversarial review — invariants I1–I5 PASS, SAFE TO MERGE