fix(canopy-store): upload validation too thin (magic bytes, filenames, scanner)

External review (2026-05-09) flagged crates/canopy-store/src/validation.rs:39 as too thin. CRAIG has more robust validation in craig-store:

• Magic-byte checks (not just MIME type — clients lie)
• Content-Disposition normalization
• Unicode filename validation (NFC normalize, reject control chars)
• AV scanner integration hook
• Periodic reconciliation: orphan-detection (DB row without object) + storage-leak detection (object without DB row)

Refs

External review (2026-05-09). CRAIG references: crates/craig-store/src/validation.rs:38, craig-store/src/scanner.rs:3.