tests: resolve all peer-review issues across test suite

Address every substantive critique from the peer review:

test_cache: replace tautological same-inputs key test with hardcoded
hash assertion; assert setex call + TTL in mark_index_cached test;
assert client is None for unavailable no-op; rename Packages.gz test
to document intentional behaviour; add alpine sig/tmp negatives; add
hyphenated and date-tag docker positive cases; add key hash-length
assertion.

test_config: replace live-constant comparisons with literal string
assertions for alpine/rpm/docker; add unknown package type test;
add dict-keyed repositories branch coverage (per-repo override and
fallback); fix cache config to full equality check; add explicit empty
index_patterns test.

test_docker_auth: fix case-insensitive test to verify realm value;
add field-order (scope before service) limitation test; add pipe-char
collision documentation test; add missing fetch_token edge cases
(no token field, HTTPStatusError, missing expires_in default 300);
replace rubber-stamp delegate test with end-to-end parse→fetch test.

test_storage: replace split prefix/suffix assertions with structural
3-part check + pinned sha256 assertion; fix Docker blob digests to
64-char hex; add secure=True URL test; add upload return value test;
add download_object 404-on-ClientError test; remove redundant subset
test.

test_routes: add metrics.record_cache_hit/miss assertions; add
mark_index_cached assertion after cache miss on index (docker + generic);
add Content-Disposition, X-Artifact-Size header checks; add rpm/xml
content-type tests; add flush test that verifies Redis keys are deleted
when cache is available; add smoke coverage for upload (PUT), HEAD, DELETE,
/metrics, and /config routes.

tests/conftest.py

@@ -5,6 +5,7 @@ Module-level setup (env vars + connection patches) runs before any test
 module is imported, so the FastAPI app initialises against mocks rather
 than real S3 / Redis / PostgreSQL services.
 """
+
 import os
 import tempfile
 from unittest.mock import MagicMock, patch
@@ -75,19 +76,21 @@ _config_path = os.path.join(_tmpdir, "remotes.yaml")
 with open(_config_path, "w") as _f:
     yaml.dump(TEST_REMOTES, _f)
 
-os.environ.update({
-    "CONFIG_PATH": _config_path,
-    "MINIO_ENDPOINT": "localhost:9000",
-    "MINIO_ACCESS_KEY": "testkey",
-    "MINIO_SECRET_KEY": "testsecret",
-    "MINIO_BUCKET": "testbucket",
-    "REDIS_URL": "redis://localhost:6379/0",
-    "DBHOST": "localhost",
-    "DBPORT": "5432",
-    "DBUSER": "test",
-    "DBPASS": "test",
-    "DBNAME": "test",
-})
+os.environ.update(
+    {
+        "CONFIG_PATH": _config_path,
+        "MINIO_ENDPOINT": "localhost:9000",
+        "MINIO_ACCESS_KEY": "testkey",
+        "MINIO_SECRET_KEY": "testsecret",
+        "MINIO_BUCKET": "testbucket",
+        "REDIS_URL": "redis://localhost:6379/0",
+        "DBHOST": "localhost",
+        "DBPORT": "5432",
+        "DBUSER": "test",
+        "DBPASS": "test",
+        "DBNAME": "test",
+    }
+)
 
 # Patch external service connections before the package is imported.
 # These stay active for the whole session (process exits after tests finish).
@@ -109,6 +112,7 @@ from fastapi.testclient import TestClient  # noqa: E402
 @pytest.fixture(scope="session")
 def app():
     from artifactapi.main import app as fastapi_app
+
     return fastapi_app