feat: add local PyPI repository support

Upload Python wheels and sdists to local PyPI repos. The simple index
(PEP 503) is computed on-demand from stored files.

- Upload validates .whl/.tar.gz/.zip filenames, parses and normalizes
  package names per PEP 503, stores under {package}/{filename}
- GET /api/v1/local/{name}/simple/ serves root index listing all packages
- GET /api/v1/local/{name}/simple/{pkg}/ serves per-package file listing
  with sha256 hashes for integrity verification
- Files are downloadable at /api/v1/local/{name}/{package}/{filename}
- Overwrites rejected with 409

Tested e2e: uv build wheel → upload → uv pip install from local repo

internal/database/local_files.go

@@ -99,6 +99,29 @@ func (db *DB) ListLocalFilesByPrefix(ctx context.Context, repoName, prefix strin
 	return files, rows.Err()
 }
 
+func (db *DB) ListLocalFilePackages(ctx context.Context, repoName string) ([]string, error) {
+	rows, err := db.Pool.Query(ctx, `
+		SELECT DISTINCT split_part(file_path, '/', 1)
+		FROM local_files
+		WHERE repo_name = $1
+		ORDER BY 1
+	`, repoName)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	var packages []string
+	for rows.Next() {
+		var pkg string
+		if err := rows.Scan(&pkg); err != nil {
+			return nil, err
+		}
+		packages = append(packages, pkg)
+	}
+	return packages, rows.Err()
+}
+
 func (db *DB) DeleteLocalFile(ctx context.Context, repoName, filePath string) error {
 	_, err := db.Pool.Exec(ctx, `DELETE FROM local_files WHERE repo_name = $1 AND file_path = $2`, repoName, filePath)
 	return err