fix(api): align upload API contract between docs, routing, and responses

[usehoplite]

Summary

Audited MPiper's main user flow — presign → direct upload → complete → processing — against actual code behavior and found the documented API contract diverges from what the server actually serves. This PR aligns docs, routing, and response payloads with verified behavior, and fixes three response fields that returned values clients could not act on.

Changes

README.md — API documentation corrected to the real routes

• POST /api/v1/assets/upload → POST /api/v1/storage/presign (the router registers /storage/presign; the documented path never existed)
• POST /api/v1/assets/{assetId}/uploaded → POST /api/v1/assets/{assetId}/complete (actual route)
• Upload response documented with the real {"status": "success", "data": {...}} envelope; "Mark Asset as Uploaded" response corrected to the handler's actual {"status": "success", "message": ...} shape (no longer claims an assetId field that isn't returned)
• Quick-start curl updated to the real endpoint with the required Authorization: Bearer <token> header

internal/router/router.go — GET /api/v1/assets/{assetID}/complete → POST
MarkAssetUploaded mutates state (DB transaction, inserts job, enqueues to Redis); registering it as GET was unsound (caches/link prefetchers can fire it, and the README already documented POST).

internal/service/asset.go — response fields clients could not use

• ObjectPath returned the client's fileName instead of the actual object key (media/raw/<assetID>) the presigned URL and worker operate on
• ExpiresAt returned relative 300 seconds while the field's contract (and README example) is an absolute Unix timestamp
• Both now derive from a single presignExpiry constant used for the presigned URL TTL as well, so they cannot drift

pkg/utils/response.go — consistent error envelope
WriteErrorResponse emitted {"success": false, ...} while every other endpoint (handlers, rate limiter, root) uses the status envelope; unified to {"status": "error", ...}.

Verification

• go build ./... — clean
• go vet ./... — clean
• go test ./internal/... ./pkg/... — all pass (TestPerformanceLatencies in tests/ requires the external PERF_TEST_URL and fails identically on the base branch; it is not affected by this change)
• Touched Go files pass gofmt (note: metrics.go, otel.go, queue.go are pre-existing gofmt violations on the base branch unrelated to this PR)

Notes for maintainers

• Per the Contributing section, feature PRs normally target staging; this PR was created against the repository's configured base (master).
• CI's lint/unit-tests jobs run only on workflow_dispatch or when the PR carries the lint / run-unit-tests labels; apply those labels to get checks on this PR.