Stable S3 key + cleanup of legacy timestamped files

### Background

Parent: avniproject/avni-client#1942. Today snapshot-server writes to `/snapshots//.db`, accumulating one file per generation per user. avni-server resolves "latest by timestamp" when serving signed URLs. This card switches to a stable filename so the key is deterministic; S3 versioning (already enabled on the bucket) preserves history natively.

`` is already the org-scoped S3 prefix (resolved per organisation by avni-server), so no additional org segment is needed in the key — `` is unique within an org.

### Scope

- Change snapshot upload to a stable key: `/snapshots//snapshot.db`.
- One-time cleanup of leftover timestamped files in user prefixes (S3 lifecycle rule or one-shot script).
- Coordinate with avni-server: `/media/mobileDatabaseSqliteSnapshotUrl/download` resolver switches from "list prefix, return latest" to "return signed URL for the stable key".

### Acceptance criteria

- [ ] snapshot-server writes to `/snapshots//snapshot.db` (no timestamp suffix, no extra org segment — `` is already org-scoped).
- [ ] avni-server resolver returns a signed URL for the stable key; updated and deployed in lockstep.
- [ ] Legacy timestamped files in existing prefixes are cleaned up (one-shot script or S3 lifecycle rule that targets the old pattern; documented and run once).
- [ ] S3 versioning is left enabled; no application-level atomic-replace logic required (S3 object writes are already atomic).
- [ ] Object metadata (or a sidecar) records generation timestamp + snapshot-server commit SHA + client schema version — needed by the freshness check in the scheduled-generation card.