fix(upload): return 4xx for upload errors and handle empty/final-chunk blobs instead of 500

[m-ferrero]

Problem

Several blob-upload error paths surface as opaque 500s rather than the correct client error:

• A wrong digest claimed on the finalizing PUT is rejected by R2's checksum verification, which bubbles up as a 500 instead of a 400.
• A zero-byte/empty blob and a final chunk carried by the finalizing PUT are not handled cleanly.

Solution

• Translate R2's checksum-mismatch on commit into 400 DIGEST_INVALID (the unit test asserts the 400 body, so a future change in the runtime's error wording surfaces as a test failure rather than a silent regression to 500).
• Store an empty blob as empty bytes (the runtime requires a known-length body, so a length-less empty stream cannot be used).
• Route a final chunk carried by the finalizing PUT through the same path a PATCH uses, so small chunks are combined into a valid part and an out-of-order chunk is rejected with 416.

Tests

Adds cases for the wrong-digest 400, the out-of-order chunk 416, the empty-blob (zero-byte) path, and the final-chunk-on-PUT path.

Part of #134.