Add github_alpine metadata-only package type

github_alpine is the Alpine/apk analog of github_deb/github_rpm: a
metadata-only remote that scans a GitHub repo's releases for .apk assets,
derives each package's .PKGINFO via a ranged prefix fetch (never
downloading whole packages), synthesizes a per-arch APKINDEX.tar.gz from
that cached metadata, and 302-redirects .apk downloads to a backend
releases_remote. It stacks on the apk-local work, reusing the alpine
provider's APKINDEX generator, .PKGINFO parser, Q1 checksum, and
AlpineMetadata store.

- pkg/models: add PackageGitHubAlpine to the enum + validators
- internal/provider/alpine/github.go: the github_alpine provider
  (ServeRemote per-arch index + .apk redirect, cold-start 503,
  scanWithState incremental derive, ranged .PKGINFO prefix fetch with
  range-doubling on truncation)
- internal/provider/alpine/syncer.go: parallel background Syncer
  (worker pool, shared limiter, deduped queue, DB lease)
- internal/database/alpine_github_sync.go + github_alpine_sync_state
  table: remote enumeration + per-remote sync lease
- internal/api/v2/remotes.go: primed on create via the shared Primer map
- internal/server/server.go: construct + Run the alpine syncer, register
  it in the Primer map
- tests mirror the deb github_test/syncer_test (scan/diff/prune, ranged
  .PKGINFO parse, per-arch ServeRemote routing, .apk 302, DB lease)

internal/server/server.go

@@ -20,7 +20,7 @@ import (
 	"git.unkin.net/unkin/artifactapi/internal/database"
 	"git.unkin.net/unkin/artifactapi/internal/gc"
 	"git.unkin.net/unkin/artifactapi/internal/githubauth"
-	_ "git.unkin.net/unkin/artifactapi/internal/provider/alpine"
+	"git.unkin.net/unkin/artifactapi/internal/provider/alpine"
 	"git.unkin.net/unkin/artifactapi/internal/provider/deb"
 	_ "git.unkin.net/unkin/artifactapi/internal/provider/docker"
 	_ "git.unkin.net/unkin/artifactapi/internal/provider/generic"
@@ -52,6 +52,7 @@ type Server struct {
 	gc           *gc.Collector
 	syncer       *rpm.Syncer
 	debSyncer    *deb.Syncer
+	alpineSyncer *alpine.Syncer
 }
 
 func New(cfg *config.Config, version string) (*Server, error) {
@@ -105,6 +106,12 @@ func New(cfg *config.Config, version string) (*Server, error) {
 		Workers:      cfg.GitHubSyncWorkers,
 		PollInterval: time.Duration(cfg.GitHubSyncPollInterval) * time.Second,
 	})
+	alpineSyncer := alpine.NewSyncer(db, alpine.SyncConfig{
+		RatePerSec:   cfg.GitHubSyncRatePerSec,
+		Burst:        cfg.GitHubSyncBurst,
+		Workers:      cfg.GitHubSyncWorkers,
+		PollInterval: time.Duration(cfg.GitHubSyncPollInterval) * time.Second,
+	})
 
 	// The terraform registry signs with a GPG key. A configured file wins (BYO
 	// key); otherwise artifactapi generates one on first start and persists it in
@@ -138,6 +145,7 @@ func New(cfg *config.Config, version string) (*Server, error) {
 		gc:           collector,
 		syncer:       syncer,
 		debSyncer:    debSyncer,
+		alpineSyncer: alpineSyncer,
 	}
 
 	s.router = s.routes()
@@ -168,8 +176,9 @@ func (s *Server) routes() chi.Router {
 	r.Mount("/v2", proxyHandler.DockerV2Routes())
 
 	remotesHandler := v2.NewRemotesHandler(s.db, map[models.PackageType]v2.Primer{
-		models.PackageGitHubRPM: s.syncer,
-		models.PackageGitHubDeb: s.debSyncer,
+		models.PackageGitHubRPM:    s.syncer,
+		models.PackageGitHubDeb:    s.debSyncer,
+		models.PackageGitHubAlpine: s.alpineSyncer,
 	})
 	virtualsHandler := v2.NewVirtualsHandler(s.db)
 	healthHandler := v2.NewHealthHandler(s.db, s.cache, s.store)
@@ -239,6 +248,7 @@ func (s *Server) Run(ctx context.Context) error {
 	go s.gc.Run(ctx)
 	go s.syncer.Run(ctx)
 	go s.debSyncer.Run(ctx)
+	go s.alpineSyncer.Run(ctx)
 
 	httpServer := s.newHTTPServer()
 
@@ -261,6 +271,7 @@ func (s *Server) RunOnListener(ctx context.Context, ln net.Listener) error {
 	go s.gc.Run(ctx)
 	go s.syncer.Run(ctx)
 	go s.debSyncer.Run(ctx)
+	go s.alpineSyncer.Run(ctx)
 
 	httpServer := s.newHTTPServer()