feat: serve local docker repos as a real registry

Local docker repos previously had no write path — the /v2 Docker Registry
API only proxied to upstreams. This makes a local docker repo a genuine
registry so `docker push`/`docker pull` (and podman/skopeo/buildah) work
against it directly, matching the project principle that a local repo is the
real thing rather than a mirror.

- Implement the Docker Registry HTTP API V2 write/read half for local docker
  repos: blob uploads (monolithic and chunked POST/PATCH/PUT), manifest push,
  tags list, and blob/manifest GET/HEAD.
- Store blobs and manifests through the existing content-addressable store;
  keep a local_files reference per (repo, image) so the GC does not reap them.
  Tags are mutable (UpsertLocalFile); digests and blobs are immutable.
- Dispatch /v2 reads to the local handler for local docker repos and fall
  through to the upstream proxy otherwise; writes are local-docker only.
- Add UpsertLocalFile for mutable tag references.
- Cover the push/pull round-trip with a dockerised e2e test and unit-test the
  registry path parser. Document the registry in the README.

README.md

@@ -119,6 +119,24 @@ there's nothing to provision. To bring your own key instead, point
 `TF_SIGNING_KEY_PASSPHRASE`), which takes precedence over the generated one.
 `TF_PROVIDER_PROTOCOLS` (default `5.0,6.0`) sets the advertised plugin protocols.
 
+### Local docker registry
+
+A local `docker` repo is a real container registry, not a mirror: it serves the
+Docker Registry HTTP API V2 for both push and pull, so any client (`docker`,
+`podman`, `skopeo`, `buildah`) can use it directly.
+
+```sh
+docker tag myapp:latest artifactapi.k8s.syd1.au.unkin.net/docker-internal/myapp:latest
+docker push        artifactapi.k8s.syd1.au.unkin.net/docker-internal/myapp:latest
+docker pull        artifactapi.k8s.syd1.au.unkin.net/docker-internal/myapp:latest
+```
+
+The first path segment after `/v2/` is the artifactapi repo name; the remainder
+is the image name. Blobs and manifests are stored through the shared
+content-addressable store (deduplicated by digest, reaped by GC once
+unreferenced); tags are mutable references and re-pushing a tag moves it. Blob
+uploads support both the monolithic and chunked (`POST`/`PATCH`/`PUT`) flows.
+
 ## Access Control
 
 | Field | Default | Behaviour |