fix: logic-audit P0/P1 wave — CORS PUT, chunked cap, presign checksums, logout await, refresh rotation race

From the logic audit (HEAD 04f5f7e):
- P0 CORS: enableCors methods lacked PUT — browsers could not chunk-upload
  at all (cross-origin preflight refused)
- P0 chunked: validateUpload enforced the 2 GiB whole-body cap on chunked
  completes, so every >2 GiB chunked upload failed after full upload
- P1 presignPut: the SDK's flexible-checksum default added an
  x-amz-checksum-crc32 header browsers cannot reproduce; S3Client now uses
  requestChecksumCalculation WHEN_REQUIRED
- P1 refresh rotation race: concurrent refreshes both succeeded (consume
  ignored rowCount) forking the token family; consume now returns whether
  it won and the loser revokes the chain
- P2 logout: awaits the revocation and ignores missing/forged bearers
honestly

apps/api/src/group-files/group-files.test.ts

@@ -129,6 +129,7 @@ describe("group-files runtime validation (shared contracts)", () => {
       id: "b3a1c2d4-1111-4222-8333-444455556666",
       workspaceId: "c3a1c2d4-1111-4222-8333-444455556666",
       groupId: "d3a1c2d4-1111-4222-8333-444455556666",
+      ownerId: null, folderId: null, createdBy: null, shared: false,
       roomId: "!r:example.org",
       senderId: "@s:example.org",
       eventId: "$evt",
@@ -146,6 +147,11 @@ describe("group-files runtime validation (shared contracts)", () => {
       status: "available",
     };
     expect(parseGroupFile(value)).toEqual(value);
+    const personal = { ...value, groupId: null, ownerId: value.id, folderId: value.id, createdBy: value.id,
+      file: { ...value.file, spaceId: null, storageKey: "sha256/key.mp4" } };
+    expect(parseGroupFile(personal)).toEqual(personal);
+    const shared = { ...value, shared: true, origin: { kind: "upload", sharedFrom: "personal" } };
+    expect(parseGroupFile(shared)).toEqual(shared);
     expect(() => parseGroupFile({ ...value, sizeBytes: -1 })).toThrow(BadRequestException);
     expect(() => parseGroupFile({ ...value, senderId: "Bob" })).toThrow(BadRequestException);
     expect(() => parseGroupFile({ ...value, checksum: { algorithm: "sha256", value: "zz" } })).toThrow(BadRequestException);