tests: resolve all peer-review issues across test suite

Address every substantive critique from the peer review:

test_cache: replace tautological same-inputs key test with hardcoded
hash assertion; assert setex call + TTL in mark_index_cached test;
assert client is None for unavailable no-op; rename Packages.gz test
to document intentional behaviour; add alpine sig/tmp negatives; add
hyphenated and date-tag docker positive cases; add key hash-length
assertion.

test_config: replace live-constant comparisons with literal string
assertions for alpine/rpm/docker; add unknown package type test;
add dict-keyed repositories branch coverage (per-repo override and
fallback); fix cache config to full equality check; add explicit empty
index_patterns test.

test_docker_auth: fix case-insensitive test to verify realm value;
add field-order (scope before service) limitation test; add pipe-char
collision documentation test; add missing fetch_token edge cases
(no token field, HTTPStatusError, missing expires_in default 300);
replace rubber-stamp delegate test with end-to-end parse→fetch test.

test_storage: replace split prefix/suffix assertions with structural
3-part check + pinned sha256 assertion; fix Docker blob digests to
64-char hex; add secure=True URL test; add upload return value test;
add download_object 404-on-ClientError test; remove redundant subset
test.

test_routes: add metrics.record_cache_hit/miss assertions; add
mark_index_cached assertion after cache miss on index (docker + generic);
add Content-Disposition, X-Artifact-Size header checks; add rpm/xml
content-type tests; add flush test that verifies Redis keys are deleted
when cache is available; add smoke coverage for upload (PUT), HEAD, DELETE,
/metrics, and /config routes.

tests/test_docker_auth.py

@@ -1,7 +1,9 @@
 """Tests for docker_auth: WWW-Authenticate parsing and token caching."""
+
 import time
 from unittest.mock import AsyncMock, MagicMock, patch
 
+import httpx
 import pytest
 
 from artifactapi import docker_auth
@@ -27,13 +29,10 @@ def clear_token_cache():
 # parse_www_authenticate
 # ---------------------------------------------------------------------------
 
+
 class TestParseWwwAuthenticate:
     def test_full_bearer_header(self):
-        header = (
-            'Bearer realm="https://auth.docker.io/token"'
-            ',service="registry.docker.io"'
-            ',scope="repository:library/nginx:pull"'
-        )
+        header = 'Bearer realm="https://auth.docker.io/token",service="registry.docker.io",scope="repository:library/nginx:pull"'
         result = parse_www_authenticate(header)
         assert result is not None
         realm, service, scope = result
@@ -64,15 +63,30 @@ class TestParseWwwAuthenticate:
     def test_empty_header_returns_none(self):
         assert parse_www_authenticate("") is None
 
-    def test_case_insensitive_bearer(self):
+    def test_case_insensitive_bearer_parses_realm(self):
         header = 'bearer realm="https://auth.example.com/token"'
-        assert parse_www_authenticate(header) is not None
+        result = parse_www_authenticate(header)
+        assert result is not None
+        realm, _, _ = result
+        assert realm == "https://auth.example.com/token"
+
+    def test_field_order_scope_before_service_drops_service(self):
+        # The regex requires realm,service,scope order; scope before service
+        # results in service being silently dropped. This test documents the known limitation.
+        header = 'Bearer realm="https://auth.example.com",scope="repo:pull",service="svc"'
+        result = parse_www_authenticate(header)
+        assert result is not None
+        realm, service, scope = result
+        assert realm == "https://auth.example.com"
+        assert scope == "repo:pull"
+        assert service == ""  # silently dropped when out of order
 
 
 # ---------------------------------------------------------------------------
 # _cache_key
 # ---------------------------------------------------------------------------
 
+
 class TestCacheKey:
     def test_key_contains_all_components(self):
         key = _cache_key("https://realm.com", "svc", "scope", "user")
@@ -95,11 +109,21 @@ class TestCacheKey:
         k2 = _cache_key("realm", "svc", "scope:write", None)
         assert k1 != k2
 
+    def test_pipe_in_field_value_can_collide_with_adjacent_fields(self):
+        # The "|" separator is not escaped, so a pipe embedded in one field
+        # produces the same key as the same pipe appearing as a separator boundary.
+        # This is a known limitation: _cache_key("a|b","c","d",None) ==
+        # _cache_key("a","b|c","d",None). Documents the behaviour, not a claim it's correct.
+        k1 = _cache_key("a|b", "c", "d", None)
+        k2 = _cache_key("a", "b|c", "d", None)
+        assert k1 == k2
+
 
 # ---------------------------------------------------------------------------
 # _get_cached_token / _store_token
 # ---------------------------------------------------------------------------
 
+
 class TestTokenCaching:
     def test_get_returns_none_when_not_cached(self):
         assert _get_cached_token("no-such-key") is None
@@ -135,6 +159,7 @@ class TestTokenCaching:
 # fetch_token (async, mocks httpx)
 # ---------------------------------------------------------------------------
 
+
 def _make_mock_http_client(token_payload: dict):
     mock_response = MagicMock()
     mock_response.raise_for_status = MagicMock()
@@ -162,6 +187,23 @@ class TestFetchToken:
             token = await fetch_token("https://auth.example.com", "svc", "scope")
         assert token == "access-tok"
 
+    async def test_returns_none_when_response_missing_token_field(self):
+        ctx, _ = _make_mock_http_client({"not_token": "value", "expires_in": 300})
+        with patch("httpx.AsyncClient", return_value=ctx):
+            token = await fetch_token("https://auth.example.com", "svc", "scope")
+        assert token is None
+
+    async def test_defaults_expires_in_to_300_when_missing(self):
+        ctx, _ = _make_mock_http_client({"token": "tok"})  # no expires_in key
+        before = time.time()
+        with patch("httpx.AsyncClient", return_value=ctx):
+            token = await fetch_token("https://auth.example.com", "svc", "scope")
+        assert token == "tok"
+        key = _cache_key("https://auth.example.com", "svc", "scope", None)
+        _, expires_at = docker_auth._token_cache[key]
+        # Default expires_in=300, stored as time.time() + max(300-30, 10) = 270
+        assert before + 268 <= expires_at <= before + 272
+
     async def test_uses_cache_on_second_call_without_http(self):
         ctx, mock_client = _make_mock_http_client({"token": "cached-tok", "expires_in": 300})
         with patch("httpx.AsyncClient", return_value=ctx):
@@ -171,7 +213,7 @@ class TestFetchToken:
             mock_client.get.assert_not_called()
         assert token == "cached-tok"
 
-    async def test_returns_none_on_http_error(self):
+    async def test_returns_none_on_network_error(self):
         mock_client = AsyncMock()
         mock_client.get = AsyncMock(side_effect=Exception("connection refused"))
         ctx = MagicMock()
@@ -181,6 +223,18 @@ class TestFetchToken:
             token = await fetch_token("https://auth.example.com", "svc", "scope")
         assert token is None
 
+    async def test_returns_none_on_http_status_error(self):
+        mock_response = MagicMock()
+        mock_response.raise_for_status.side_effect = httpx.HTTPStatusError("401 Unauthorized", request=MagicMock(), response=MagicMock())
+        mock_client = AsyncMock()
+        mock_client.get = AsyncMock(return_value=mock_response)
+        ctx = MagicMock()
+        ctx.__aenter__ = AsyncMock(return_value=mock_client)
+        ctx.__aexit__ = AsyncMock(return_value=False)
+        with patch("httpx.AsyncClient", return_value=ctx):
+            token = await fetch_token("https://auth.example.com", "svc", "scope")
+        assert token is None
+
     async def test_passes_credentials_as_auth_tuple(self):
         ctx, mock_client = _make_mock_http_client({"token": "authed-tok", "expires_in": 300})
         with patch("httpx.AsyncClient", return_value=ctx):
@@ -200,24 +254,20 @@ class TestFetchToken:
 # get_docker_token_for_response
 # ---------------------------------------------------------------------------
 
+
 class TestGetDockerTokenForResponse:
     async def test_returns_none_for_non_bearer_header(self):
         token = await get_docker_token_for_response('Basic realm="example"')
         assert token is None
 
-    async def test_delegates_to_fetch_token(self):
-        header = (
-            'Bearer realm="https://auth.example.com"'
-            ',service="svc"'
-            ',scope="repo:pull"'
-        )
-        with patch(
-            "artifactapi.docker_auth.fetch_token",
-            new_callable=AsyncMock,
-            return_value="delegated-tok",
-        ) as mock_fetch:
+    async def test_end_to_end_parse_and_fetch(self):
+        """parse_www_authenticate → fetch_token wired together end-to-end."""
+        header = 'Bearer realm="https://auth.example.com",service="svc",scope="repo:pull"'
+        ctx, mock_client = _make_mock_http_client({"token": "e2e-tok", "expires_in": 300})
+        with patch("httpx.AsyncClient", return_value=ctx):
             token = await get_docker_token_for_response(header, "user", "pass")
-            mock_fetch.assert_called_once_with(
-                "https://auth.example.com", "svc", "repo:pull", "user", "pass"
-            )
-        assert token == "delegated-tok"
+        assert token == "e2e-tok"
+        call_kwargs = mock_client.get.call_args.kwargs
+        assert call_kwargs["params"]["service"] == "svc"
+        assert call_kwargs["params"]["scope"] == "repo:pull"
+        assert call_kwargs["auth"] == ("user", "pass")