fix: omit creator email from v2 asset responses

[Optic00]

API-v2 asset responses include the creator's email even when the bearer token cannot access the user API. V1 deliberately omitted this information from assets.

This restores that boundary for asset creation, detail reads, updates and lists. Both V2 mounts use the same representation. Creator identity and other asset fields remain available; the email must be obtained through the separately permission-checked user API. Single-asset response redaction copies the model instead of changing service-owned state.

The HTTP regression fails on Core cbd4f521 for all four operations on both mounts and passes with this fix. It uses synthetic accounts, verifies a nonempty source email, confirms that the asset-only token cannot read /users/me, and checks that asset identity survives redaction.

All nine retained V1 scenarios remain covered, alongside V2 equivalents and outsider, Viewer, Editor and Administrator checks with persisted outcomes. The asset/CLI-asset subset passes on SQLite and PostgreSQL with this branch.

Tests are in the companion test branch. Kept in draft alongside the ongoing API-v2 test migration. No production instance was accessed.

[stefan-ernst]

Thank you, good find! Still working on corrections for v2 api, this is a useful one