feat: add local PyPI repository support

Upload Python wheels and sdists to local PyPI repos. The simple index
(PEP 503) is computed on-demand from stored files.

- Upload validates .whl/.tar.gz/.zip filenames, parses and normalizes
  package names per PEP 503, stores under {package}/{filename}
- GET /api/v1/local/{name}/simple/ serves root index listing all packages
- GET /api/v1/local/{name}/simple/{pkg}/ serves per-package file listing
  with sha256 hashes for integrity verification
- Files are downloadable at /api/v1/local/{name}/{package}/{filename}
- Overwrites rejected with 409

Tested e2e: uv build wheel → upload → uv pip install from local repo

internal/api/v1/proxy.go

@@ -115,10 +115,15 @@ func (h *ProxyHandler) handleLocal(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	if remote.PackageType == models.PackageTerraform {
+	switch remote.PackageType {
+	case models.PackageTerraform:
 		if h.serveTerraformMirror(w, r, remote, path) {
 			return
 		}
+	case models.PackagePyPI:
+		if h.servePyPIMirror(w, r, remote, path) {
+			return
+		}
 	}
 
 	h.serveLocalFile(w, r, localName, path)
@@ -149,6 +154,24 @@ func (h *ProxyHandler) serveTerraformMirror(w http.ResponseWriter, r *http.Reque
 	return false
 }
 
+func (h *ProxyHandler) servePyPIMirror(w http.ResponseWriter, r *http.Request, remote *models.Remote, path string) bool {
+	if path == "simple" || path == "simple/" {
+		h.local.ServePyPIIndex(w, r, remote.Name)
+		return true
+	}
+
+	if strings.HasPrefix(path, "simple/") {
+		pkg := strings.TrimPrefix(path, "simple/")
+		pkg = strings.TrimSuffix(pkg, "/")
+		if pkg != "" && !strings.Contains(pkg, "/") {
+			h.local.ServePyPIPackageIndex(w, r, remote.Name, pkg)
+			return true
+		}
+	}
+
+	return false
+}
+
 func (h *ProxyHandler) serveLocalFile(w http.ResponseWriter, r *http.Request, repoName, path string) {
 	file, err := h.db.GetLocalFile(r.Context(), repoName, path)
 	if err != nil {