Add Alpine/apk local repository support (#114)

## Why

The alpine provider only supported remote (proxy) repositories, so there was no way to publish first-party `.apk` packages the way `rpm-local` and `deb-local` already allow. This extends the existing alpine provider into a real apk repository: uploaded `.apk` files are parsed in pure Go and a per-arch `APKINDEX.tar.gz` is generated on demand, at parity with rpm repodata and deb Packages generation. (The metadata-only `github_alpine` type is a separate follow-up and is not part of this PR.)

## How

- Implements `LocalUploader` / `LocalIndexer` / `PostUploadHook` / `PostDeleteHook` on the existing `alpine` provider, leaving the remote proxy methods (`UpstreamURL`/`ContentType`/`AuthHeaders`/`RewriteResponse`/`Classify`) intact.
- Parses the `.apk` (up to three concatenated, independently gzipped tar streams) in pure Go: locates the control stream by its `.PKGINFO` member, reads the `key = value` fields, and computes the apk pull checksum `C:` = `Q1` + base64(sha1(**control gzip stream bytes**)) — the sha1 of the second gzip member, not of the whole file.
- Derives arch from `.PKGINFO` and records download size (`S:` blob size) and installed size (`I:` from `.PKGINFO size`).
- Generates an **unsigned** per-arch `APKINDEX.tar.gz` = gzip(tar(`APKINDEX`)) filtered by requested arch (clients use `--allow-untrusted`, matching rpm `gpgcheck=0` / deb `[trusted=yes]`), applying the same dot-segment normalization as deb so `./<arch>/APKINDEX.tar.gz` resolves. Non-index / `.apk` paths return `false` so the generic file streamer serves the stored blob.
- Adds `AlpineMetadata` plus **separate** `AlpineMetadataStore` / `AlpineMetadataReader` / `AlpineMetadataDeleter` interfaces (type-asserted from the generic hooks) so the shared rpm/deb metadata interfaces and their test doubles are untouched.
- Adds the `alpine_metadata` table (keyed by `repo_name` + `file_path`, per-arch index) and its `Insert`/`Delete`/`List` DB methods.
- Adds `testsupport.MinimalApk`, unit tests (`.PKGINFO` parse, Q1 checksum over the control stream, per-arch filtering, empty-field omission, `./` dot-segment handling, ValidateUpload accept/reject), and a `dockere2e` `TestLocalAlpineIndex`.

## Consumption

`/etc/apk/repositories` line = `<url>/api/v1/local/<name>` (apk appends `/<arch>/APKINDEX.tar.gz`); `apk update --allow-untrusted && apk add --allow-untrusted <pkg>`. Packages live at `/api/v1/local/<name>/<arch>/<file>.apk`.

## Verification

`go build ./...`, `go vet ./...` (incl. `-tags dockere2e`), `go mod tidy` (no change), `make test` (`-race`), and `pre-commit run --all-files` all pass.

Reviewed-on: #114
Co-authored-by: unkin-agent <unkin-agent@unkin.net>
Co-committed-by: unkin-agent <unkin-agent@unkin.net>

internal/provider/provider.go

@@ -115,6 +115,50 @@ type DebMetadata struct {
 	SHA256       string
 }
 
+// AlpineMetadataStore / AlpineMetadataDeleter / AlpineMetadataReader are the
+// Alpine-specific persistence surfaces. They are kept separate from the shared
+// RPM/Deb metadata interfaces so the apk provider can type-assert the generic
+// MetadataStore/MetadataDeleter/FileStore it is handed without widening (and
+// thus perturbing the test doubles of) the rpm and deb providers. *database.DB
+// satisfies all three.
+type AlpineMetadataStore interface {
+	InsertAlpineMetadata(ctx context.Context, meta *AlpineMetadata) error
+}
+
+type AlpineMetadataDeleter interface {
+	DeleteAlpineMetadata(ctx context.Context, repoName, filePath string) error
+}
+
+type AlpineMetadataReader interface {
+	ListAlpineMetadataEntries(ctx context.Context, repoName string) ([]AlpineMetadata, error)
+}
+
+// AlpineMetadata is the derived per-package metadata for an Alpine .apk, holding
+// the fields an APKINDEX record carries plus the apk pull checksum (Q1…, the
+// sha1 of the control gzip stream) and the download/installed sizes.
+type AlpineMetadata struct {
+	RepoName         string
+	FilePath         string
+	ContentHash      string
+	Checksum         string   // C: "Q1" + base64(sha1(control gzip stream))
+	Name             string   // P:
+	Version          string   // V:
+	Arch             string   // A:
+	DownloadSize     int64    // S: on-disk .apk size
+	InstalledSize    int64    // I: unpacked size from .PKGINFO
+	Description      string   // T:
+	URL              string   // U:
+	License          string   // L:
+	Origin           string   // o:
+	Maintainer       string   // m:
+	BuildTime        int64    // t:
+	Commit           string   // c:
+	ProviderPriority string   // k:
+	Depends          []string // D:
+	Provides         []string // p:
+	InstallIf        []string // i:
+}
+
 type RPMMetadata struct {
 	RepoName      string
 	FilePath      string