feat: v3 Go rewrite — full artifact proxy with web UI, TUI, and Terraform provider

Complete rewrite of ArtifactAPI from Python/FastAPI to Go as a single binary.

Core engine:
- 10 package providers: generic, docker, helm, pypi, npm, rpm, alpine,
  puppet, terraform, goproxy — each with built-in mutable patterns
- Content-addressable storage (SHA256 dedup across all remotes)
- Three-tier caching: Redis (TTL/locks) → S3/MinIO (blobs) → upstream
- Classifier with allowlist/blocklist per-remote (empty = allow all)
- Circuit breaker, conditional revalidation, stale-on-error
- Background garbage collection for orphaned blobs
- Access logging to PostgreSQL

API:
- v1 proxy endpoints (backwards compatible)
- v2 management API: CRUD remotes/virtuals, object browser, stats,
  health, SSE events, probe/test endpoint
- Virtual repos with index merging (Helm YAML + PyPI HTML)

Frontend (React + Vite, separate Dockerfile):
- Dashboard with stats, health indicators, top remotes
- Remotes list with type filter, remote detail with config/patterns
- Object browser with pagination and evict
- Test Remote page: probe any remote path, see headers/size/timing
- Virtuals page with expandable member lists

TUI (Bubble Tea):
- Dashboard, remotes list/detail, object browser, virtuals
- Vim-style navigation, artifactapi tui --endpoint <url>

Infrastructure:
- S3 client supports MinIO, Ceph RGW, AWS S3 (minio-go)
- PostgreSQL schema with migrations
- Docker Compose: API + UI + Postgres 17 + Redis 7 + MinIO
- Makefile with Go version check, build/test/lint/fmt/e2e targets
- Distroless Docker image (~15MB)

Testing:
- Unit tests for models, classifier, providers, mergers
- E2E tests with testcontainers-go (real Postgres/Redis/MinIO)

Terraform config:
- All 40 production remotes + helm virtual as HCL
- Provider repo: terraform-provider-artifactapi v0.0.1 (separate)

internal/api/v2/remotes.go

@@ -0,0 +1,96 @@
+package v2
+
+import (
+	"encoding/json"
+	"fmt"
+	"net/http"
+
+	"github.com/go-chi/chi/v5"
+
+	"git.unkin.net/unkin/artifactapi/internal/database"
+	"git.unkin.net/unkin/artifactapi/pkg/models"
+)
+
+type RemotesHandler struct {
+	db *database.DB
+}
+
+func NewRemotesHandler(db *database.DB) *RemotesHandler {
+	return &RemotesHandler{db: db}
+}
+
+func (h *RemotesHandler) Routes() chi.Router {
+	r := chi.NewRouter()
+	r.Get("/", h.list)
+	r.Post("/", h.create)
+	r.Get("/{name}", h.get)
+	r.Put("/{name}", h.update)
+	r.Delete("/{name}", h.del)
+	return r
+}
+
+func (h *RemotesHandler) list(w http.ResponseWriter, r *http.Request) {
+	remotes, err := h.db.ListRemotes(r.Context())
+	if err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	writeJSON(w, http.StatusOK, remotes)
+}
+
+func (h *RemotesHandler) get(w http.ResponseWriter, r *http.Request) {
+	name := chi.URLParam(r, "name")
+	remote, err := h.db.GetRemote(r.Context(), name)
+	if err != nil {
+		http.Error(w, fmt.Sprintf("remote %q not found", name), http.StatusNotFound)
+		return
+	}
+	writeJSON(w, http.StatusOK, remote)
+}
+
+func (h *RemotesHandler) create(w http.ResponseWriter, r *http.Request) {
+	var remote models.Remote
+	if err := json.NewDecoder(r.Body).Decode(&remote); err != nil {
+		http.Error(w, "invalid json", http.StatusBadRequest)
+		return
+	}
+	if !remote.PackageType.Valid() {
+		http.Error(w, fmt.Sprintf("invalid package type: %q", remote.PackageType), http.StatusBadRequest)
+		return
+	}
+	if err := h.db.CreateRemote(r.Context(), &remote); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	writeJSON(w, http.StatusCreated, remote)
+}
+
+func (h *RemotesHandler) update(w http.ResponseWriter, r *http.Request) {
+	name := chi.URLParam(r, "name")
+	var remote models.Remote
+	if err := json.NewDecoder(r.Body).Decode(&remote); err != nil {
+		http.Error(w, "invalid json", http.StatusBadRequest)
+		return
+	}
+	remote.Name = name
+	if err := h.db.UpdateRemote(r.Context(), &remote); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	writeJSON(w, http.StatusOK, remote)
+}
+
+func (h *RemotesHandler) del(w http.ResponseWriter, r *http.Request) {
+	name := chi.URLParam(r, "name")
+	if err := h.db.DeleteRemote(r.Context(), name); err != nil {
+		http.Error(w, err.Error(), http.StatusInternalServerError)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+func writeJSON(w http.ResponseWriter, status int, v any) {
+	w.Header().Set("Content-Type", "application/json")
+	w.WriteHeader(status)
+	json.NewEncoder(w).Encode(v)
+}