Support TUS Checksum extension

## Scope

Implement the TUS Checksum extension so clients can opt in to per-chunk integrity verification. When the client sends Upload-Checksum: sha256 , the server compares it to the SHA-256 of the received chunk body and returns HTTP 460 on mismatch.

## Deliverables

- `errors/upload.py` — ChunkChecksumMismatchError (HTTP 460), InvalidUploadChecksumHeaderError (400).
- `api/client.py` — _parse_upload_checksum_header, verification in tus_upload_part, advertise Tus-Extension: checksum and Tus-Checksum-Algorithm: sha256 in OPTIONS.
- Tests for matching/mismatched/malformed checksum headers.

## Acceptance

- Clients that do not send Upload-Checksum see no behavior change.
- Only sha256 algorithm accepted; others return 400.
- Temp chunk file is cleaned up on mismatch.

## Depends on

BA-3974 [3/6] (handler rewire).

JIRA Issue: BA-6158