Get the parts of a job's metadata a UI reads, projected server-side.

The blob is stored in the private job-files bucket rather than on the job row, and no client has storage grants of its own, so this endpoint is how it is read. Only JOB_METADATA_CLIENT_KEYS come back — the rest is worker-sized and would be discarded. The response is sanitised (NaN/Infinity become null) and is therefore always valid JSON.

Returns {} — not 404 — while the blob has not been written yet, so a caller polling a running job sees an empty object rather than an error. GET /jobs/{job_id}/metadata remains the whole-blob, 404-on-missing form for scripted clients.