Feat/v3 go rewrite (#47)

Complete rewrite of ArtifactAPI from Python/FastAPI to Go as a single binary.

Core engine:
- 10 package providers: generic, docker, helm, pypi, npm, rpm, alpine,
  puppet, terraform, goproxy — each with built-in mutable patterns
- Content-addressable storage (SHA256 dedup across all remotes)
- Three-tier caching: Redis (TTL/locks) → S3/MinIO (blobs) → upstream
- Classifier with allowlist/blocklist per-remote (empty = allow all)
- Circuit breaker, conditional revalidation, stale-on-error
- Background garbage collection for orphaned blobs
- Access logging to PostgreSQL

API:
- v1 proxy endpoints (backwards compatible)
- v2 management API: CRUD remotes/virtuals, object browser, stats,
  health, SSE events, probe/test endpoint
- Virtual repos with index merging (Helm YAML + PyPI HTML)

Frontend (React + Vite, separate Dockerfile):
- Dashboard with stats, health indicators, top remotes
- Remotes list with type filter, remote detail with config/patterns
- Object browser with pagination and evict
- Test Remote page: probe any remote path, see headers/size/timing
- Virtuals page with expandable member lists

TUI (Bubble Tea):
- Dashboard, remotes list/detail, object browser, virtuals
- Vim-style navigation, artifactapi tui --endpoint <url>

Infrastructure:
- S3 client supports MinIO, Ceph RGW, AWS S3 (minio-go)
- PostgreSQL schema with migrations
- Docker Compose: API + UI + Postgres 17 + Redis 7 + MinIO
- Makefile with Go version check, build/test/lint/fmt/e2e targets
- Distroless Docker image (~15MB)

Testing:
- Unit tests for models, classifier, providers, mergers
- E2E tests with testcontainers-go (real Postgres/Redis/MinIO)

Terraform config:
- All 40 production remotes + helm virtual as HCL
- Provider repo: terraform-provider-artifactapi v0.0.1 (separate)

---------

Co-authored-by: Ben Vincent <ben@unkin.net>
Reviewed-on: #47

internal/storage/cas.go

@@ -0,0 +1,72 @@
+package storage
+
+import (
+	"context"
+	"crypto/sha256"
+	"encoding/hex"
+	"fmt"
+	"io"
+	"os"
+)
+
+type CAS struct {
+	s3 *S3
+}
+
+func NewCAS(s3 *S3) *CAS {
+	return &CAS{s3: s3}
+}
+
+type CASResult struct {
+	ContentHash   string
+	S3Key         string
+	SizeBytes     int64
+	AlreadyExists bool
+}
+
+func (c *CAS) Store(ctx context.Context, reader io.Reader, contentType string) (*CASResult, error) {
+	tmp, err := os.CreateTemp("", "artifact-*")
+	if err != nil {
+		return nil, fmt.Errorf("create temp file: %w", err)
+	}
+	defer os.Remove(tmp.Name())
+	defer tmp.Close()
+
+	hasher := sha256.New()
+	size, err := io.Copy(io.MultiWriter(tmp, hasher), reader)
+	if err != nil {
+		return nil, fmt.Errorf("write temp file: %w", err)
+	}
+
+	hash := hex.EncodeToString(hasher.Sum(nil))
+	s3Key := BlobKey(hash)
+
+	exists, err := c.s3.Exists(ctx, s3Key)
+	if err != nil {
+		return nil, fmt.Errorf("check blob exists: %w", err)
+	}
+
+	if !exists {
+		if _, err := tmp.Seek(0, io.SeekStart); err != nil {
+			return nil, fmt.Errorf("seek temp file: %w", err)
+		}
+		if err := c.s3.Upload(ctx, s3Key, tmp, size, contentType); err != nil {
+			return nil, fmt.Errorf("upload blob: %w", err)
+		}
+	}
+
+	return &CASResult{
+		ContentHash:   fmt.Sprintf("sha256:%s", hash),
+		S3Key:         s3Key,
+		SizeBytes:     size,
+		AlreadyExists: exists,
+	}, nil
+}
+
+func BlobKey(hash string) string {
+	return fmt.Sprintf("blobs/sha256/%s", hash)
+}
+
+func IndexKey(remote, path string) string {
+	return fmt.Sprintf("indexes/%s/%s", remote, path)
+}