feat: assemble completed uploads

Implement POST /api/uploads/{id}/complete. The storage layer now reloads upload
metadata, verifies that every expected chunk exists with the exact expected
length, concatenates chunks in order into a temporary final file, flushes it,
and renames it into data/complete only after assembly succeeds.

The endpoint preserves staging data after completion, rejects incomplete uploads
with a conflict response, and refuses to overwrite an existing completed file.
This keeps failed or duplicate completion attempts explicit rather than silently
clobbering local files.

Extend the model, router, documentation, and test checklist for completion
responses and add integration coverage for successful assembly, incomplete
uploads, staging preservation, and duplicate completion conflicts.

Test Plan:
- just check

Refs: PLAN.md milestone 8

TESTS.md

@@ -16,6 +16,8 @@ Keep this file as the reusable verification checklist while implementing
     - `PUT /api/uploads/:id/chunks/:index` rejects wrong-size chunks.
     - `PUT /api/uploads/:id/chunks/:index` accepts duplicate chunks.
     - `GET /api/uploads/:id` reports completed chunks from disk.
+    - `POST /api/uploads/:id/complete` assembles verified chunks.
+    - `POST /api/uploads/:id/complete` rejects incomplete uploads.
 
 ## Manual