feat: v3 Go rewrite — full artifact proxy with web UI, TUI, and Terraform provider

Complete rewrite of ArtifactAPI from Python/FastAPI to Go as a single binary.

Core engine:
- 10 package providers: generic, docker, helm, pypi, npm, rpm, alpine,
  puppet, terraform, goproxy — each with built-in mutable patterns
- Content-addressable storage (SHA256 dedup across all remotes)
- Three-tier caching: Redis (TTL/locks) → S3/MinIO (blobs) → upstream
- Classifier with allowlist/blocklist per-remote (empty = allow all)
- Circuit breaker, conditional revalidation, stale-on-error
- Background garbage collection for orphaned blobs
- Access logging to PostgreSQL

API:
- v1 proxy endpoints (backwards compatible)
- v2 management API: CRUD remotes/virtuals, object browser, stats,
  health, SSE events, probe/test endpoint
- Virtual repos with index merging (Helm YAML + PyPI HTML)

Frontend (React + Vite, separate Dockerfile):
- Dashboard with stats, health indicators, top remotes
- Remotes list with type filter, remote detail with config/patterns
- Object browser with pagination and evict
- Test Remote page: probe any remote path, see headers/size/timing
- Virtuals page with expandable member lists

TUI (Bubble Tea):
- Dashboard, remotes list/detail, object browser, virtuals
- Vim-style navigation, artifactapi tui --endpoint <url>

Infrastructure:
- S3 client supports MinIO, Ceph RGW, AWS S3 (minio-go)
- PostgreSQL schema with migrations
- Docker Compose: API + UI + Postgres 17 + Redis 7 + MinIO
- Makefile with Go version check, build/test/lint/fmt/e2e targets
- Distroless Docker image (~15MB)

Testing:
- Unit tests for models, classifier, providers, mergers
- E2E tests with testcontainers-go (real Postgres/Redis/MinIO)

Terraform config:
- All 40 production remotes + helm virtual as HCL
- Provider repo: terraform-provider-artifactapi v0.0.1 (separate)

internal/gc/gc.go

@@ -0,0 +1,67 @@
+package gc
+
+import (
+	"context"
+	"log/slog"
+	"time"
+
+	"git.unkin.net/unkin/artifactapi/internal/database"
+	"git.unkin.net/unkin/artifactapi/internal/storage"
+)
+
+type Collector struct {
+	db       *database.DB
+	store    *storage.S3
+	interval time.Duration
+}
+
+func New(db *database.DB, store *storage.S3, interval time.Duration) *Collector {
+	return &Collector{db: db, store: store, interval: interval}
+}
+
+func (c *Collector) Run(ctx context.Context) {
+	slog.Info("gc started", "interval", c.interval)
+	ticker := time.NewTicker(c.interval)
+	defer ticker.Stop()
+
+	for {
+		select {
+		case <-ctx.Done():
+			slog.Info("gc stopped")
+			return
+		case <-ticker.C:
+			c.sweep(ctx)
+		}
+	}
+}
+
+func (c *Collector) sweep(ctx context.Context) {
+	start := time.Now()
+
+	orphaned, err := c.db.FindOrphanedBlobs(ctx)
+	if err != nil {
+		slog.Error("gc: find orphaned blobs", "error", err)
+		return
+	}
+
+	deleted := 0
+	for _, blob := range orphaned {
+		if err := c.store.Delete(ctx, blob.S3Key); err != nil {
+			slog.Warn("gc: delete s3 object", "key", blob.S3Key, "error", err)
+			continue
+		}
+		if err := c.db.DeleteBlob(ctx, blob.ContentHash); err != nil {
+			slog.Warn("gc: delete blob row", "hash", blob.ContentHash, "error", err)
+			continue
+		}
+		deleted++
+	}
+
+	if deleted > 0 || len(orphaned) > 0 {
+		slog.Info("gc sweep complete",
+			"orphaned_found", len(orphaned),
+			"deleted", deleted,
+			"duration_ms", time.Since(start).Milliseconds(),
+		)
+	}
+}

internal/gc/gc_test.go

@@ -0,0 +1,15 @@
+package gc_test
+
+import (
+	"testing"
+	"time"
+
+	"git.unkin.net/unkin/artifactapi/internal/gc"
+)
+
+func TestNew(t *testing.T) {
+	c := gc.New(nil, nil, 1*time.Hour)
+	if c == nil {
+		t.Fatal("expected non-nil collector")
+	}
+}