* Ask the server which images it still shows before dropping an upload

The upload queue decided whether a pending upload was still wanted by
reading the strategy's full snapshot. It now asks the new
images:listReferencedAssetIds query: every image the server's content
shows, read from the reference rows, or null while the reference
backfill has not finished (the queue then keeps the upload and asks
again). Nothing changes for users today.

This ships before the page trash (#228). The trash hides deleted pages
from the full snapshot while their images are still wanted, so a client
still reading the snapshot could drop the bytes of an image on a page
that can be restored.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Test the uncertain answer on a staged upload, the job it holds

A durable upload may upload while the server cannot tell (nothing the
user made is lost that way); a staged one keeps its check, its job and
its bytes, and never uploads. The test now covers the staged case, where
the answer decides.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Ask only about the images in question, a bounded batch at a time

listReferencedAssetIds read every live reference row of the strategy,
so a strategy with tens of thousands of image references (thousands of
lineups sharing screenshots) would pass Convex's read limit and never
get an answer. It now takes the asset ids the client holds uploads for,
at most 100 per call, and looks each up through the strategy/asset/
deleted index. The repository asks in batches of 100; if any batch
cannot tell, the answer is null.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

* Say, when reading a full snapshot, that the trash's pages may be left out

getFullSnapshot takes an optional acceptsTrashedPagesLeftOut, ignored
for now; this client sends it. Once the server keeps deleted pages in a
trash (#228), it can refuse a snapshot to a client that does not send it
while the strategy holds trashed pages: such a client decides from the
snapshot whether an upload is still wanted, and would drop the bytes of
an image on a page that can be restored. A refused read already keeps
the bytes.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>