fix(uploads): store upload bytes per version

[TheGreatAxios]

Summary

• artifact_version.source records each version's content reference and size. GET /artifacts/:id/download?version=N and GET /artifacts/:id/versions/:version return that version's file; omitting version serves the latest.
• POST /artifacts/:id/versions with a multipart file (and optional expectedVersion) revises an upload with new bytes through the ContentStore and upload policy (reviseFileArtifact). The bytes are stored only after the row is locked and expectedVersion holds, so a 409 writes no blob. More than one file field is refused. The title carries forward.
• Migration 0004_version_source backfills every existing version from its artifact, so 0.1.0 uploads download as version 1.
• createWorkflowArtifactRoutes(deps) replaces mountWorkflowArtifacts(app, opts): the run-scoped routes are a sub-app factory like createArtifactRoutes. MountWorkflowArtifactsOpts is renamed CreateWorkflowArtifactRoutesDeps.
• On upgrade from 0.1.0, 0002 grants create on artifact:* in the host's grant table to every principal that has already created an artifact in its tenant, before it drops the 0.1.0 ledger. It runs only while the ledger exists, so a later revoke sticks. New principals need the grant.
• The real-Postgres suites move to e2e/, with the shared harness in e2e/helpers.ts and e2e/fixtures.ts. bun run test runs src/, bun run test:e2e runs e2e/, and test:coverage runs both.
• The README follows the Corbits README standard (hub module). CONTRIBUTING adds the rule that a backfill must be cheap once it has run.
• The find-by-title recency test no longer ties on timestamps.
• Release 0.2.0: the version is bumped, and the CHANGELOG is one dated 0.2.0 section with every breaking change, including no rollback to 0.1.0 after the ledger drop and the Node 24 floor.
• Stacked on refactor!: remove skill-draft, web_site handling and mail attachments #30; top of the stack.

Verification

• bun install --frozen-lockfile, bun run build, bun run typecheck: pass.
• bun run test:coverage against local Postgres (ALLOW_DESTRUCTIVE_ARTIFACT_TESTS=1): 292 pass, 0 fail, coverage floor met.
• e2e/upgrade-from-0.1.0.test.ts upgrades a database written by the published 0.1.0: a 0.1.0 creator still gets 201 on create, a new principal gets 403, and re-running the migrations adds no grants.
• e2e/file-round-trip.test.ts asserts each version's bytes and source, and that a stale expectedVersion revise leaves no file on disk.
• Every README snippet typechecks against the built dist.

Closes CL-9336

[TheGreatAxios]

Self-review: the review found that a file revise overwrote the title; this is fixed (title carries forward). Known and unchanged: multipart bodies are buffered before the size check, same as the upload route. The source merge reads the artifact before the lock; it is harmless today because nothing else rewrites source.