test: raise core-package unit coverage to 90% (#98)

Raises statement coverage of the core packages (all of `internal/` except the interactive `tui/`, plus `pkg/`) from **8.7% to 90.1%**.

## Approach
- **Pure-go unit tests** for all providers, virtual mergers, classifier, config, auth, models, and the API client (httptest).
- **Testcontainers-backed** tests (new `internal/testsupport` helper: Postgres/Redis/MinIO, Ryuk disabled) for database, storage, cache, the proxy engine, the GC, and a full-stack `server` test that drives the whole HTTP API. These `t.Skip` when Docker is absent so `go test` still runs locally without it.

## Measuring
```
go test -coverpkg=./internal/...,./pkg/... -coverprofile=cover.out ./internal/... ./pkg/...
grep -v /internal/tui/ cover.out | go tool cover -func=/dev/stdin | tail -1   # 90.1%
```
Run with `-p 1` (containers are heavy).

## Notes
- The interactive `tui/` package and `cmd/main` are excluded from the target per the agreed scope.
- Some defensive error branches are covered via fault injection (closed DB pool, killing MinIO mid-upload).

Reviewed-on: #98
Co-authored-by: Ben Vincent <ben@unkin.net>
Co-committed-by: Ben Vincent <ben@unkin.net>

internal/provider/puppet/puppet_test.go

@@ -0,0 +1,78 @@
+package puppet
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+func TestType(t *testing.T) {
+	if (&Provider{}).Type() != models.PackagePuppet {
+		t.Fatal("wrong type")
+	}
+}
+
+func TestClassify(t *testing.T) {
+	p := &Provider{}
+	if p.Classify("v3/modules/puppetlabs-stdlib") != provider.Mutable {
+		t.Error("modules should be mutable")
+	}
+	if p.Classify("v3/releases?module=x") != provider.Mutable {
+		t.Error("releases should be mutable")
+	}
+	if p.Classify("v3/files/puppetlabs-stdlib-1.0.0.tar.gz") != provider.Immutable {
+		t.Error("files should be immutable")
+	}
+}
+
+func TestContentType(t *testing.T) {
+	p := &Provider{}
+	if p.ContentType("x/mod-1.0.0.tar.gz") != "application/gzip" {
+		t.Error("tar.gz")
+	}
+	if p.ContentType("v3/modules/x") != "application/json" {
+		t.Error("v3 json")
+	}
+	if p.ContentType("other") != "application/octet-stream" {
+		t.Error("default")
+	}
+}
+
+func TestUpstreamURL(t *testing.T) {
+	got := (&Provider{}).UpstreamURL(models.Remote{BaseURL: "https://forgeapi.puppet.com/"}, "/v3/modules/x")
+	if got != "https://forgeapi.puppet.com/v3/modules/x" {
+		t.Errorf("got %q", got)
+	}
+}
+
+func TestRewriteResponse(t *testing.T) {
+	p := &Provider{}
+	remote := models.Remote{Name: "forge", BaseURL: "https://forgeapi.puppet.com"}
+
+	if out, _ := p.RewriteResponse([]byte("x"), remote, ""); out != nil {
+		t.Error("empty proxyBaseURL is a no-op")
+	}
+
+	body := []byte(`{"file_uri":"/v3/files/mod.tar.gz","home":"https://forgeapi.puppet.com/x"}`)
+	out, err := p.RewriteResponse(body, remote, "http://proxy")
+	if err != nil {
+		t.Fatal(err)
+	}
+	s := string(out)
+	if !strings.Contains(s, "http://proxy/api/v1/remote/forge/v3/files/mod.tar.gz") {
+		t.Errorf("v3/files not rewritten: %s", s)
+	}
+	if !strings.Contains(s, "http://proxy/api/v1/remote/forge/x") {
+		t.Errorf("base URL not rewritten: %s", s)
+	}
+}
+
+func TestAuthHeaders(t *testing.T) {
+	h, _ := (&Provider{}).AuthHeaders(context.Background(), models.Remote{})
+	if h.Get("Authorization") != "" {
+		t.Error("no credentials, no header")
+	}
+}