Feat/v3 go rewrite (#47)

Complete rewrite of ArtifactAPI from Python/FastAPI to Go as a single binary.

Core engine:
- 10 package providers: generic, docker, helm, pypi, npm, rpm, alpine,
  puppet, terraform, goproxy — each with built-in mutable patterns
- Content-addressable storage (SHA256 dedup across all remotes)
- Three-tier caching: Redis (TTL/locks) → S3/MinIO (blobs) → upstream
- Classifier with allowlist/blocklist per-remote (empty = allow all)
- Circuit breaker, conditional revalidation, stale-on-error
- Background garbage collection for orphaned blobs
- Access logging to PostgreSQL

API:
- v1 proxy endpoints (backwards compatible)
- v2 management API: CRUD remotes/virtuals, object browser, stats,
  health, SSE events, probe/test endpoint
- Virtual repos with index merging (Helm YAML + PyPI HTML)

Frontend (React + Vite, separate Dockerfile):
- Dashboard with stats, health indicators, top remotes
- Remotes list with type filter, remote detail with config/patterns
- Object browser with pagination and evict
- Test Remote page: probe any remote path, see headers/size/timing
- Virtuals page with expandable member lists

TUI (Bubble Tea):
- Dashboard, remotes list/detail, object browser, virtuals
- Vim-style navigation, artifactapi tui --endpoint <url>

Infrastructure:
- S3 client supports MinIO, Ceph RGW, AWS S3 (minio-go)
- PostgreSQL schema with migrations
- Docker Compose: API + UI + Postgres 17 + Redis 7 + MinIO
- Makefile with Go version check, build/test/lint/fmt/e2e targets
- Distroless Docker image (~15MB)

Testing:
- Unit tests for models, classifier, providers, mergers
- E2E tests with testcontainers-go (real Postgres/Redis/MinIO)

Terraform config:
- All 40 production remotes + helm virtual as HCL
- Provider repo: terraform-provider-artifactapi v0.0.1 (separate)

---------

Co-authored-by: Ben Vincent <ben@unkin.net>
Reviewed-on: #47

internal/provider/generic/generic.go

@@ -0,0 +1,68 @@
+package generic
+
+import (
+	"context"
+	"encoding/base64"
+	"net/http"
+	"path"
+	"strings"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+func init() {
+	provider.Register(&Provider{})
+}
+
+type Provider struct{}
+
+func (p *Provider) Type() models.PackageType { return models.PackageGeneric }
+
+func (p *Provider) Classify(_ string) provider.Mutability {
+	return provider.Immutable
+}
+
+var contentTypeMap = map[string]string{
+	".tar.gz": "application/gzip",
+	".tgz":    "application/gzip",
+	".gz":     "application/gzip",
+	".zip":    "application/zip",
+	".whl":    "application/zip",
+	".exe":    "application/x-msdownload",
+	".rpm":    "application/x-rpm",
+	".xml":    "application/xml",
+	".yaml":   "text/yaml",
+	".yml":    "text/yaml",
+	".json":   "application/json",
+	".sig":    "application/octet-stream",
+}
+
+func (p *Provider) ContentType(filePath string) string {
+	lower := strings.ToLower(filePath)
+	if strings.HasSuffix(lower, ".tar.gz") {
+		return "application/gzip"
+	}
+	ext := path.Ext(lower)
+	if ct, ok := contentTypeMap[ext]; ok {
+		return ct
+	}
+	return "application/octet-stream"
+}
+
+func (p *Provider) UpstreamURL(remote models.Remote, reqPath string) string {
+	base := strings.TrimRight(remote.BaseURL, "/")
+	return base + "/" + strings.TrimLeft(reqPath, "/")
+}
+
+func (p *Provider) RewriteResponse(_ []byte, _ models.Remote, _ string) ([]byte, error) {
+	return nil, nil
+}
+
+func (p *Provider) AuthHeaders(_ context.Context, remote models.Remote) (http.Header, error) {
+	h := http.Header{}
+	if remote.Username != "" {
+		h.Set("Authorization", "Basic "+base64.StdEncoding.EncodeToString([]byte(remote.Username+":"+remote.Password)))
+	}
+	return h, nil
+}

internal/provider/generic/generic_test.go

@@ -0,0 +1,69 @@
+package generic_test
+
+import (
+	"context"
+	"testing"
+
+	"git.unkin.net/unkin/artifactapi/internal/provider"
+	"git.unkin.net/unkin/artifactapi/internal/provider/generic"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+func TestProvider_Type(t *testing.T) {
+	p := &generic.Provider{}
+	if p.Type() != models.PackageGeneric {
+		t.Errorf("expected generic, got %q", p.Type())
+	}
+}
+
+func TestProvider_Classify_AllImmutable(t *testing.T) {
+	p := &generic.Provider{}
+	paths := []string{"file.tar.gz", "path/to/binary", "index.html", "data.json"}
+	for _, path := range paths {
+		if p.Classify(path) != provider.Immutable {
+			t.Errorf("generic should classify %q as immutable", path)
+		}
+	}
+}
+
+func TestProvider_ContentType(t *testing.T) {
+	p := &generic.Provider{}
+	tests := []struct{ path, want string }{
+		{"file.tar.gz", "application/gzip"},
+		{"file.tgz", "application/gzip"},
+		{"file.zip", "application/zip"},
+		{"file.rpm", "application/x-rpm"},
+		{"file.json", "application/json"},
+		{"file.unknown", "application/octet-stream"},
+	}
+	for _, tt := range tests {
+		if got := p.ContentType(tt.path); got != tt.want {
+			t.Errorf("ContentType(%q) = %q, want %q", tt.path, got, tt.want)
+		}
+	}
+}
+
+func TestProvider_UpstreamURL(t *testing.T) {
+	p := &generic.Provider{}
+	got := p.UpstreamURL(models.Remote{BaseURL: "https://example.com/repo"}, "path/to/file.tar.gz")
+	want := "https://example.com/repo/path/to/file.tar.gz"
+	if got != want {
+		t.Errorf("got %q, want %q", got, want)
+	}
+}
+
+func TestProvider_AuthHeaders_BasicAuth(t *testing.T) {
+	p := &generic.Provider{}
+	h, _ := p.AuthHeaders(context.Background(), models.Remote{Username: "user", Password: "pass"})
+	if h.Get("Authorization") != "Basic dXNlcjpwYXNz" {
+		t.Errorf("unexpected auth header: %q", h.Get("Authorization"))
+	}
+}
+
+func TestProvider_AuthHeaders_NoAuth(t *testing.T) {
+	p := &generic.Provider{}
+	h, _ := p.AuthHeaders(context.Background(), models.Remote{})
+	if h.Get("Authorization") != "" {
+		t.Error("expected no auth header")
+	}
+}