feat: serve local terraform repos as a provider registry

Local terraform repos already spoke the network mirror protocol, which needs
per-consumer .terraformrc config. This adds the provider registry protocol so
`terraform init` installs from a bare source address
(artifactapi.k8s.../{repo}/{type}) with no client setup.

- serve /.well-known/terraform.json service discovery and the providers.v1
  versions/download endpoints under /terraform/v1/providers
- map the Terraform namespace to the artifactapi repo name and locate the
  provider by type; download_url points back at the existing local file path
- generate SHA256SUMS per version and sign it with a GPG key loaded from
  TF_SIGNING_KEY_PATH; advertise the public key + key id in the download
  response. No key configured -> registry stays disabled (endpoints 404)
- new internal/tfsign (key loading + detached signing) and
  internal/api/terraform (registry handler); export ParseProviderZip for reuse
- add TF_SIGNING_KEY_PATH/PASSPHRASE and TF_PROVIDER_PROTOCOLS config
- unit test signing + verification; dockerised test of the full flow incl.
  signature verification against the advertised key

Also anchor the terraform/ gitignore to the repo root so it stops swallowing
internal/api/terraform and internal/provider/terraform test files (the latter
had gone silently untracked).

README.md

@@ -89,6 +89,34 @@ resource "artifactapi_virtual" "helm" {
 
 Provider: [terraform-provider-artifactapi](../terraform-provider-artifactapi)
 
+### Serving providers as a registry
+
+A local `terraform` repo is a real provider registry: upload
+`terraform-provider-{type}_{version}_{os}_{arch}.zip` files under
+`{namespace}/{type}/`, and Terraform installs them from a bare source address —
+no `.terraformrc` mirror config:
+
+```hcl
+terraform {
+  required_providers {
+    artifactapi = {
+      source  = "artifactapi.k8s.syd1.au.unkin.net/<repo>/<type>"
+      version = "0.1.2"
+    }
+  }
+}
+```
+
+The Terraform *namespace* segment is the artifactapi repo name; the provider is
+matched by *type*. The registry serves service discovery
+(`/.well-known/terraform.json`), the `providers.v1` version/download endpoints,
+and a GPG-signed `SHA256SUMS` per the provider registry protocol.
+
+Signing requires an armored GPG private key, supplied via `TF_SIGNING_KEY_PATH`
+(optionally `TF_SIGNING_KEY_PASSPHRASE`). Without it the registry endpoints stay
+disabled. `TF_PROVIDER_PROTOCOLS` (default `5.0,6.0`) sets the advertised plugin
+protocols.
+
 ## Access Control
 
 | Field | Default | Behaviour |