Closes the loop — a tenant now enables watermark purely via token claims.

- Claims: sanitizeWatermark() assembles + clamps the watermark_* claims at decode
  (opacity 0–1, font 8–200, position whitelist, type text|logo) into Claims.watermark
  (null when off); allow_download already added in M3.
- FileManager.imgBaseUrl() mints Claims.watermark into the ImageToken, so img_base
  actually watermarks. Combined with M3: a preview-only token (allow_download=false,
  watermark_enabled) lists images with only a watermarked img_base — no clean path.
- Forward the 7 watermark_* claims + allow_download through fluxfiles_token's $webp
  array, Laravel/WordPress overrides, and Node createToken (camelCase).
- Bump laravel/wordpress fluxfiles/fluxfiles floor to ^0.2.24 (the core adding these
  claims); the adapter-core-floor guard skips until that tag is released.

Tests: claims parse/clamp + embed forward; img_base token carries the watermark;
laravel/wordpress/node forwarding. Full core + img/stream e2e green; plain smokes
pass against live core (floor guard skips pending the tag).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>