fix: map remaining user-input errors to 4xx and restore 0.1.0 invariants

[TheGreatAxios]

Closes CL-9441

• createdAfter/createdBefore outside years 1 to 9999 return 400.
• Version refs, ?version=, the versions cursor and expectedVersion above the int4 max (MAX_VERSION) return 400, on both the tenant and workflow mounts.
• Workflow POST /artifacts/binary and link-file map ArtifactSizeError to 400.
• A multipart body with a bad or missing boundary returns 400 on upload and file revise.
• readArtifact throws ArtifactNotFoundError for a missing version, so workflow read?version= returns 404.
• Migration 0005_schema_invariants adds 0.1.0's artifact_version_gte_1, artifact_version_version_gte_1 and upload_size_gte_0 CHECKs when missing, and sets artifact.tenant_id NOT NULL when it is nullable and has no NULLs. Otherwise it leaves the column alone and the runner logs the warning via console.warn.
• e2e tests cover each case.