feat(api): album asset upload chain

P1b Task 3: initAlbumAssetUpload / completeAlbumAssetUpload (tags
[assets]) over album_assets with in-row one-shot sessions.

- migration asset_state: album_assets + state (pending|effective),
  expectedBytes, contentType (utf8mb4_0900_bin); pre-existing rows
  backfilled to effective. Complete head-verifies bytes AND
  contentType vs the init declaration (P1a Task 11 server-side
  fallback), then conditionally flips pending->effective with the
  winner writing the album.asset.add audit (resourceId=albumId,
  metadata assetId/kind/locale). Effective rows re-complete
  idempotently (re-signed URL, no re-verify, survives object
  cleanup).
- object key is the final key (albums/{albumId}/assets/{assetId}.{ext});
  the pending row is the logical staging - no copy step, keys embed
  assetId so re-init can never overwrite another row's object.
- permissions: owner/admin only (collaborator 403, outsider 404);
  uploadEnabled does NOT gate assets (switch governs photo uploads
  per 4.9 - both endpoints carry no ALBUM_UPLOAD_DISABLED).
- public banner now locale-aware (req 4.7): effective rows resolved
  as display-locale row -> global (locale NULL) row -> null, latest
  wins per tier (same-kind re-upload replaces, old rows retained).
- e2e: test/assets.e2e-spec.ts (14 cases, real jpegs via sharp,
  MinIO round-trips); public spec seed marked effective.

Co-Authored-By: Claude Code <noreply@anthropic.com>

packages/db-cn/prisma/schema.prisma

@@ -117,12 +117,15 @@ model category_translations {
 }
 
 model album_assets {
-  id        String   @id @default(cuid())
-  albumId   String   @db.VarChar(64)
-  kind      String   @db.VarChar(16) // banner|cover|logo
-  locale    String?  @db.VarChar(16)
-  objectKey String   @db.VarChar(255)
-  createdAt DateTime @default(now()) @db.DateTime(6)
+  id            String   @id @default(cuid())
+  albumId       String   @db.VarChar(64)
+  kind          String   @db.VarChar(16) // banner|cover|logo
+  locale        String?  @db.VarChar(16)
+  objectKey     String   @db.VarChar(255)
+  state         String   @default("pending") @db.VarChar(16) // pending|effective（行内一次性上传会话，P1b Task 3）
+  expectedBytes Int      @default(0) // init 申明字节数（complete head 核验依据）
+  contentType   String   @default("") @db.VarChar(64) // init 申明 MIME（complete head 核验依据）
+  createdAt     DateTime @default(now()) @db.DateTime(6)
 
   @@index([albumId, kind])
 }