Preserve CHARX media names and character-local asset paths - #6125

CHARX imports now preserve creator-provided filenames for gallery images, audio, video, and JSON, and store them under the character's media folders. Expression sprites retain their existing normalized labels. These paths work with the existing file routes and user-installed regex scripts.

Validation against real archives exposed two data/path problems: colliding non-sprite filenames could overwrite assets, and literal percent signs were decoded twice by the file route. Imports now choose stable collision suffixes and serve encoded filenames correctly. APNG and AVIF support is also preserved.

Validated on upstream staging at ad29cbda6:

• npm run lint and tests lint pass; tests lint reports two existing warnings.
• 417 unit tests pass.
• 10 browser tests pass, including five real and three synthetic local archives and 2,655 HTTP asset-byte comparisons.
• Generated valid image/audio/video fixtures cover decoding, regex installation, malformed archives, percent-containing filenames, and traversal rejection. Private character archives are not committed.

Reproduce against a disposable server with ST_BASE_URL, ST_CHARX_IMPORT_E2E=1, and optionally ST_CHARX_FIXTURE_DIR: run npx playwright test charx-import.e2e.js --workers=1 from tests.

• I have read the Contribution guidelines.