fix(assets): verify uploaded cosmetic size from the R2 listing

[diangogav]

Summary

Publishing an emote pack failed with HTTP 500:

R2 upload size mismatch for "emote-packs/halloween-duelist/pack.json": local=538, write=538, remote=0

The write reported all 538 bytes, but stat() on the object returned a size of 0. The upload script stored the same file under a probe key and read its size back from the bucket listing, which showed 538 bytes. So the object was stored in full, and stat() reported the wrong size.

R2CosmeticAssetStorage now reads the stored size from list({ prefix }), the same way upload-cosmetic-asset.ts already does. A mismatch, or an object missing from the listing, still deletes the object and fails the publish. A failed publish already deletes the files it uploaded.

Earlier cosmetics published fine because they were mostly larger image files. This was the first upload of a small JSON file.

Verification

• New R2CosmeticAssetStorage tests:
  • A listed size that matches is accepted even when stat() reports 0.
  • A size mismatch, a missing object or a short write is rejected and deletes the object.
• bun test: 691 pass, 0 fail.
• bun run lint and bun run build --noEmit are clean.