Add /upload/status endpoint and progress headers

## Scope

Surface the session metadata so clients can recover precisely after a proxy crash. Standard TUS HEAD only returns Upload-Offset, which is ambiguous when chunks arrived out of order; this sub-task adds a JSON endpoint that exposes received chunks and missing byte ranges.

## Deliverables

- GET /upload/status?token=… returning JSON: session, total_size, committed_offset, chunks_received, missing_ranges, progress_percent, status.
- X-Backend-Ai-Chunks-Received / X-Backend-Ai-Progress-Percent / X-Backend-Ai-Total-Expected headers on PATCH response (additive, 204 unchanged).
- Tests for status endpoint (empty / partial / out-of-order / missing-session) and progress headers.

## Acceptance

- Standard TUS clients are unaffected (endpoint is purely additive).
- missing_ranges is correct for arbitrary out-of-order chunk arrivals.
- Endpoint is authenticated via the same upload JWT token.

## Depends on

BA-3974 [3/6] (handler rewire).

JIRA Issue: BA-6159