feat(coordinator): artifact upload/download endpoints (CTX-05, part 2)

Wire the artifact storage foundation to HTTP.

- PUT /tasks/{id}/artifacts/{filename}: a worker streams a partial result;
  the coordinator verifies lease ownership (foreign worker → 409), streams
  the bytes to blob storage while hashing, and records the metadata. An
  orphaned blob from a failed metadata insert is cleaned up.
- GET /artifacts/{id}/download: streams an artifact back with its content
  type, length, and checksum.
- Ownership is read with a new non-locking TaskRepository.Get, so no row lock
  is held across a long upload. Identity travels in X-Worker-ID / X-Task-Attempt
  headers per the contract; upload/download bypass the short request timeout.
- docker-compose mounts ./data for durable artifact storage; smoke and
  requests.http exercise an upload → foreign-409 → download round-trip.

docs/api-contract.md

@@ -19,11 +19,12 @@ must be updated in the same change as any behaviour it describes.
 | `POST /workers/register` | register + capabilities | ✅ done |
 | `POST /tasks/claim` | atomic lease | ✅ done |
 | `POST /tasks/{id}/heartbeat` | renew lease | ✅ done |
-| `POST /tasks/{id}/result` | complete | 🟡 done, but result is a URI today; moves to `artifact_id` in CTX-05 |
+| `POST /tasks/{id}/result` | complete | 🟡 done, but result is a URI today; moves to `artifact_id` next |
 | `POST /tasks/{id}/failure` | fail | ✅ done |
 | `GET /jobs/{id}` | progress | ✅ done |
-| `GET /tasks/{id}/input` | download shard | ❌ CTX-05 |
-| `PUT /tasks/{id}/artifacts/{name}` | upload partial | ❌ CTX-05 |
+| `PUT /tasks/{id}/artifacts/{name}` | upload partial | ✅ done |
+| `GET /artifacts/{id}/download` | download by id | ✅ done |
+| `GET /tasks/{id}/input` | download shard | ❌ needs input artifacts (upload+chunking) |
 
 ---