feat(coordinator): artifact upload/download endpoints (CTX-05, part 2)

Wire the artifact storage foundation to HTTP.

- PUT /tasks/{id}/artifacts/{filename}: a worker streams a partial result;
  the coordinator verifies lease ownership (foreign worker → 409), streams
  the bytes to blob storage while hashing, and records the metadata. An
  orphaned blob from a failed metadata insert is cleaned up.
- GET /artifacts/{id}/download: streams an artifact back with its content
  type, length, and checksum.
- Ownership is read with a new non-locking TaskRepository.Get, so no row lock
  is held across a long upload. Identity travels in X-Worker-ID / X-Task-Attempt
  headers per the contract; upload/download bypass the short request timeout.
- docker-compose mounts ./data for durable artifact storage; smoke and
  requests.http exercise an upload → foreign-409 → download round-trip.

coordinator/.env.example

@@ -11,6 +11,9 @@ WORKER_AUTH_TOKEN=change-me
 LOG_LEVEL=info
 # LOG_FILE=./logs/coordinator.log
 
+# Directory where artifact bytes are stored.
+COORDINATOR_STORAGE_DIR=./data
+
 # Optional tuning (defaults shown).
 DB_MAX_CONNS=10
 # How long to keep retrying the initial DB connection while Postgres boots.