feat(assets): harden signed manifest lifecycle

[diangogav]

Summary

• Return an absolute assetsExpiresAt timestamp with signed cosmetic asset manifests.
• Mark signed URL responses as Cache-Control: private, no-store.
• Add focused refresh endpoints:
  • GET /cosmetics/:id/assets
  • GET /me/cosmetics/:id/assets
• Persist asset_files, including a migration and an idempotent bun run index:cosmetic-assets backfill, to avoid R2 ListObjects calls on the manifest hot path.
• Preserve the existing access and entitlement checks.

Why

R2 objects themselves do not expire after 600 seconds; that duration belongs to the presigned URLs. The previous flow treated the client receipt time as the expiry reference, refreshed the full cosmetics catalog, and listed R2 objects for each manifest. This change makes expiry explicit, allows one cosmetic to be refreshed, and moves object discovery out of the request hot path.

Deployment

1. Run bun run migration:cosmetics:run.
2. Run bun run index:cosmetic-assets.
3. Deploy the API.

The backfill is resumable and idempotent. While asset_files is null, the API retains the existing R2 listing fallback.

Validation

• Full push hook: 283 tests passed, 0 failed.
• TypeScript build succeeded.
• Scoped Biome checks passed.

Compatibility

• The existing assets response remains unchanged.
• assetsExpiresAt is additive, so existing clients continue to work.
• The frontend integration will follow in a separate PR.