refactor: move business logic out of presentation — ReadAssetFile, checksum, auth checks, MetadataValue conversions

crates/application/src/catalog/queries/get_asset.rs

@@ -10,6 +10,7 @@ use std::sync::Arc;
 #[derive(Debug, Clone, serde::Serialize, serde::Deserialize)]
 pub struct GetAssetQuery {
     pub asset_id: SystemId,
+    pub user_id: SystemId,
 }
 
 pub struct GetAssetHandler {
@@ -38,6 +39,10 @@ impl GetAssetHandler {
             .await?
             .ok_or_else(|| DomainError::NotFound(format!("Asset {} not found", query.asset_id)))?;
 
+        if asset.owner_user_id != query.user_id {
+            return Err(DomainError::Forbidden("Access denied".to_string()));
+        }
+
         let layers = self.metadata_repo.find_by_asset(&asset.asset_id).await?;
         let resolved = resolve_metadata(&layers);