Scope temporary resources to the creating account

[zmofei]

Summary

Temporary resources (mapbox://temp/...) created from large tool responses are now scoped to the account that created them, enforced on read.

Changes

• TemporaryResource records the creating account (Mapbox username); temporaryResourceManager.create() accepts an owner.
• The directions, isochrone, and static_map_image tools pass the caller's account when storing a temporary resource.
• TemporaryDataResource.read resolves the requester the same way tools resolve their token (request auth, then the env token for stdio/single-user) and only returns the resource to the same account; otherwise it returns the standard not-found response — identical to a missing/expired resource.
• Adds test/resources/temporary/TemporaryDataResource.test.ts (same-account read, cross-account denial, no-existence-oracle, env-token fallback, image blobs).

Testing

• npm test — full suite green (incl. the new file)
• npm run build, npm run lint
• End-to-end: a real directions_tool call creating a temp resource is readable by the creating account and returns not-found to a different account.