Avoid ambiguous asset metadata and operation receipt routes

internal/platform/http.go

@@ -151,7 +151,7 @@ func Register(mux *http.ServeMux, db *sql.DB, callbacks map[string]string, origi
 	mux.HandleFunc("/projects/{project}/workspaces/{workspace}/materials", s.protected(callbacks, s.materials))
 	mux.HandleFunc("/projects/{project}/workspaces/{workspace}/assets", s.protected(callbacks, s.uploadAsset))
 	mux.HandleFunc("/projects/{project}/workspaces/{workspace}/assets/operations/{request}", s.protected(callbacks, s.assetOperation))
-	mux.HandleFunc("/projects/{project}/workspaces/{workspace}/assets/{asset}/metadata", s.protected(callbacks, s.getAssetMetadata))
+	mux.HandleFunc("/projects/{project}/workspaces/{workspace}/assets/metadata/{asset}", s.protected(callbacks, s.getAssetMetadata))
 	mux.HandleFunc("/projects/{project}/workspaces/{workspace}/assets/{asset}", s.protected(callbacks, s.getAsset))
 	mux.HandleFunc("/projects/{project}/workspaces/{workspace}/materials/{material}", s.protected(callbacks, s.material))
 	mux.HandleFunc("/projects/{project}/workspaces/{workspace}/materials/{material}/canvas", s.protected(callbacks, s.canvas))

internal/platform/integration_test.go

@@ -585,7 +585,7 @@ func TestOnboardingAndSharing(t *testing.T) {
 		}
 	}
 	// Metadata discloses the same immutable identity only after a fresh read permission check.
-	metadataPath := workspacePath + "/assets/" + uploaded["id"].(string) + "/metadata"
+	metadataPath := workspacePath + "/assets/metadata/" + uploaded["id"].(string)
 	for _, sample := range []struct {
 		token  string
 		status int