feat(routes)!: replace mountArtifacts with createArtifactRoutes

[TheGreatAxios]

Summary

• createArtifactRoutes(deps): Hono<TenantEnv> builds its own sub-app the way hub-api's createGrantRoutes does, and the host mounts it with app.route. mountArtifacts and MountArtifactsOpts are removed with no alias. The deps type is now CreateArtifactRoutesDeps.
• POST /artifacts and POST /artifacts/upload run principalRequired and then requireGrant("artifact:*", "create") before reading the body. This matches hub-api gating grant creation on grant:*. Revise and archive still require per-artifact grants.
• The reference host seeds artifact:* / create for the principals it creates.
• README, CONTRIBUTING, CHANGELOG (Breaking), the CI consumer check and the workflow-mount comments use the new name. The CHANGELOG notes the change in the 403 body text on the two create routes.
• mountWorkflowArtifacts is unchanged here; fix(uploads): store upload bytes per version #31 converts it. The mail-attachment routes still need only a principal, the README says so, and refactor!: remove skill-draft, web_site handling and mail attachments #30 removes them.
• The test host in mount.test.ts passes the factory's no-op defaults explicitly, since exactOptionalPropertyTypes rules out passing undefined without a spread. The create handlers keep the file's existing unreachable null-scope guard after principalRequired.
• Stacked on feat(migrations)!: ship SQL migrations applied like runMigrations #27.

Verification

• typecheck clean
• 325 package tests pass against Postgres 16, including a new test through the real createRequireGrant: with the create grant it returns 201, without it 403, and nothing is written on a refusal
• build, then 42 reference-host acceptance tests pass

Closes CL-9053

[TheGreatAxios]

Reviewed both commits, one fresh review plus three re-reviews. The factory has the same shape as createGrantRoutes, and both create routes gate on artifact:* create before reading the body. Revise and archive keep their per-artifact grants. No references to mountArtifacts remain outside the CHANGELOG. The new test drives the real grant evaluator and checks that a refusal writes nothing. Two findings were waived by Greybeard, as described in the PR body.