Add image content hashing for integrity and deduplication

[catherineluse]

Background

Image assets currently use stable IDs and metadata, but do not use a content hash. Hashes would strengthen migration/restore verification and make safe deduplication possible.

Scope

• Choose and document a browser-compatible content hash algorithm and encoding.
• Add a nullable/versioned hash field without blocking existing libraries.
• Compute hashes during new image ingestion and progressively backfill legacy assets.
• Verify migrated and restored blobs against recorded hashes.
• Evaluate deduplicating identical bytes without breaking asset-level metadata or deletion semantics.

Acceptance criteria

• Existing unhashed assets continue to work.
• New assets receive deterministic hashes.
• Integrity mismatches produce actionable errors and do not silently replace data.
• Deduplication, if enabled, maintains correct reference counts/lifecycle.
• Tests cover hashing, backfill, mismatch, and duplicate content.