Reject bare * and unknown remotes on evict, serialise with fetch lock

- return 400 for a bare * and 404 for an unknown remote
- take the per-path fetch lock for single-path evicts
- pass the evictor to Routes so local routes no longer carry it
- test If-None-Match revalidation, ForgetPath/ForgetPrefix glob escaping

internal/server/server.go

@@ -195,13 +195,13 @@ func (s *Server) routes() chi.Router {
 		r.Mount("/probe", probeHandler.Routes())
 
 		r.Route("/remotes/{name}/objects", func(r chi.Router) {
-			objHandler := v2.NewObjectsHandler(s.db, s.engine)
-			r.Get("/", objHandler.Routes().ServeHTTP)
-			r.Delete("/*", objHandler.Routes().ServeHTTP)
+			objHandler := v2.NewObjectsHandler(s.db)
+			r.Get("/", objHandler.Routes(s.engine).ServeHTTP)
+			r.Delete("/*", objHandler.Routes(s.engine).ServeHTTP)
 		})
 
 		r.Route("/locals/{name}/objects", func(r chi.Router) {
-			objHandler := v2.NewObjectsHandler(s.db, s.engine)
+			objHandler := v2.NewObjectsHandler(s.db)
 			r.Get("/", objHandler.LocalRoutes().ServeHTTP)
 			r.Delete("/*", objHandler.LocalRoutes().ServeHTTP)
 		})