feat: add local repository type with repo_type field

Introduces repo_type (remote/local) as a separate axis from package_type
so that any package type can be hosted locally. A terraform local repo
is package_type=terraform + repo_type=local.

- Remote model gains RepoType field (defaults to "remote")
- Database schema adds repo_type column with migration for existing DBs
- V1 proxy adds /api/v1/local/{name}/* route for serving local files
- V2 upload via PUT /api/v2/remotes/{name}/files/{ns}/{type}/{file}.zip
  validates filename matches terraform-provider-{type}_{ver}_{os}_{arch}.zip
  and returns 409 on duplicate (no overwrites)
- index.json and {version}.json are computed on-the-fly from uploaded zips
  rather than stored as separate files
- V2 create validates repo_type and requires base_url only for remotes

internal/api/v1/proxy.go

@@ -6,28 +6,38 @@ import (
 	"io"
 	"log/slog"
 	"net/http"
+	"regexp"
+	"strings"
 
 	"github.com/go-chi/chi/v5"
 
+	v2 "git.unkin.net/unkin/artifactapi/internal/api/v2"
 	"git.unkin.net/unkin/artifactapi/internal/database"
 	"git.unkin.net/unkin/artifactapi/internal/provider"
 	"git.unkin.net/unkin/artifactapi/internal/proxy"
+	"git.unkin.net/unkin/artifactapi/internal/storage"
 	"git.unkin.net/unkin/artifactapi/internal/virtual"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
 )
 
+var semverRe = regexp.MustCompile(`^[0-9]+\.[0-9]+\.[0-9]+(?:-[a-zA-Z0-9.]+)?$`)
+
 type ProxyHandler struct {
 	engine        *proxy.Engine
 	virtualEngine *virtual.Engine
 	db            *database.DB
+	store         *storage.S3
+	local         *v2.LocalHandler
 }
 
-func NewProxyHandler(engine *proxy.Engine, virtualEngine *virtual.Engine, db *database.DB) *ProxyHandler {
-	return &ProxyHandler{engine: engine, virtualEngine: virtualEngine, db: db}
+func NewProxyHandler(engine *proxy.Engine, virtualEngine *virtual.Engine, db *database.DB, store *storage.S3, local *v2.LocalHandler) *ProxyHandler {
+	return &ProxyHandler{engine: engine, virtualEngine: virtualEngine, db: db, store: store, local: local}
 }
 
 func (h *ProxyHandler) Routes() chi.Router {
 	r := chi.NewRouter()
 	r.Get("/remote/{remoteName}/*", h.handleProxy)
+	r.Get("/local/{localName}/*", h.handleLocal)
 	r.Get("/virtual/{virtualName}/*", h.handleVirtual)
 	return r
 }
@@ -95,6 +105,78 @@ func (h *ProxyHandler) handleVirtual(w http.ResponseWriter, r *http.Request) {
 	w.Write(body)
 }
 
+func (h *ProxyHandler) handleLocal(w http.ResponseWriter, r *http.Request) {
+	localName := chi.URLParam(r, "localName")
+	path := chi.URLParam(r, "*")
+
+	remote, err := h.db.GetRemote(r.Context(), localName)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("local %q not found", localName), http.StatusNotFound)
+		return
+	}
+
+	if remote.PackageType == models.PackageTerraform {
+		if h.serveTerraformMirror(w, r, remote, path) {
+			return
+		}
+	}
+
+	h.serveLocalFile(w, r, localName, path)
+}
+
+func (h *ProxyHandler) serveTerraformMirror(w http.ResponseWriter, r *http.Request, remote *models.Remote, path string) bool {
+	parts := strings.Split(path, "/")
+	if len(parts) < 3 {
+		return false
+	}
+
+	namespace, typeName := parts[0], parts[1]
+	tail := parts[2]
+
+	if tail == "index.json" {
+		h.local.ServeTerraformIndex(w, r, remote.Name, namespace, typeName)
+		return true
+	}
+
+	if strings.HasSuffix(tail, ".json") {
+		version := strings.TrimSuffix(tail, ".json")
+		if semverRe.MatchString(version) {
+			h.local.ServeTerraformVersionDoc(w, r, remote.Name, namespace, typeName, version)
+			return true
+		}
+	}
+
+	return false
+}
+
+func (h *ProxyHandler) serveLocalFile(w http.ResponseWriter, r *http.Request, repoName, path string) {
+	file, err := h.db.GetLocalFile(r.Context(), repoName, path)
+	if err != nil {
+		slog.Error("local file lookup failed", "repo", repoName, "path", path, "error", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	if file == nil {
+		http.Error(w, "not found", http.StatusNotFound)
+		return
+	}
+
+	s3Key := storage.BlobKey(file.ContentHash[len("sha256:"):])
+	reader, info, err := h.store.Download(r.Context(), s3Key)
+	if err != nil {
+		slog.Error("local file download failed", "repo", repoName, "path", path, "error", err)
+		http.Error(w, "internal error", http.StatusInternalServerError)
+		return
+	}
+	defer reader.Close()
+
+	w.Header().Set("Content-Type", info.ContentType)
+	w.Header().Set("Content-Length", fmt.Sprintf("%d", info.Size))
+	w.Header().Set("X-Artifact-Source", "local")
+	w.WriteHeader(http.StatusOK)
+	io.Copy(w, reader)
+}
+
 func scheme(r *http.Request) string {
 	if r.TLS != nil {
 		return "https"