feat(coordinator): artifact upload/download endpoints (CTX-05, part 2)

Wire the artifact storage foundation to HTTP.

- PUT /tasks/{id}/artifacts/{filename}: a worker streams a partial result;
  the coordinator verifies lease ownership (foreign worker → 409), streams
  the bytes to blob storage while hashing, and records the metadata. An
  orphaned blob from a failed metadata insert is cleaned up.
- GET /artifacts/{id}/download: streams an artifact back with its content
  type, length, and checksum.
- Ownership is read with a new non-locking TaskRepository.Get, so no row lock
  is held across a long upload. Identity travels in X-Worker-ID / X-Task-Attempt
  headers per the contract; upload/download bypass the short request timeout.
- docker-compose mounts ./data for durable artifact storage; smoke and
  requests.http exercise an upload → foreign-409 → download round-trip.

coordinator/docker-compose.yml

@@ -57,10 +57,13 @@ services:
       # Logs are teed to stdout (docker logs) and this rotated file, which lives
       # on the mounted ./logs directory so it survives a rebuild.
       LOG_FILE: /var/log/scimesh/coordinator.log
+      # Artifact bytes land on the mounted ./data directory, durable across rebuilds.
+      COORDINATOR_STORAGE_DIR: /var/lib/scimesh/artifacts
     ports:
       - "${COORDINATOR_PORT:-8080}:8080"
     volumes:
       - ./logs:/var/log/scimesh
+      - ./data:/var/lib/scimesh/artifacts
     healthcheck:
       test: ["CMD", "wget", "-qO-", "http://127.0.0.1:8080/health"]
       interval: 10s