Add agent-friendly public asset API

[MicrowaveDev]

Summary

• add trusted origin-only discovery, request IDs, stable problem responses, and actionable OpenAPI
• add digest-verified idempotent asset uploads, immutable read headers, stable async operations, scoped credentials, resumable batches, and deterministic manifests
• compact completed batch item rows after a configurable 30-day retention window while preserving the idempotency record, manifest, and uploaded assets
• align every nginx topology, add a production-shaped proxy gate, migrations/inventories, executable examples, and Meat Master consumer proof

Verification

• focused contract/regression suite (50 passing)
• Docker proxy and batch-retention integration (4 passing on the final source snapshot)
• full Docker suite: 628 passing, 11 pending; six stale response-shape assertions were updated and then passed in focused host (50 passing) and rebuilt-Docker (14 passing) runs
• migration integrity passed against model-synced PostgreSQL
• security route inventory and database scalability inventory are current
• Backpack Game Core: 381 passing and package dry-run
• Meat Master: 88 passing and script-doc check

Consumer companion PRs

• MicrowaveDev/backpack-game-core#2
• nuclear-pancakes/meat-master#2

Closes #1312