Initial release: self-hostable APT repository server and CLI

urapt is a self-hostable APT repository server with a companion CLI for
pushing and managing Debian .deb packages.

Server (urapt-server):
- REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO)
- .deb files stored content-addressed on disk, reference-counted for dedup
- Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto)
- APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand
  from the DB, cached in memory, signed with the server key
- Full APT model: repositories -> distributions -> components -> architectures
- Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads
- First registrant becomes admin; repo-scoped permissions
  (read/write/read-write/admin) plus owner and server-admin roles
- Multipart package push with control-field extraction, list/show/delete,
  pool serving, blob ref-count cleanup
- Audit log

CLI (urapt):
- register/login/logout/whoami, token management
- repo/distro/component/arch CRUD, member management
- push/pull/ls/show/rm for packages
- apt-config helper that emits apt setup commands (key, sources.list,
  auth.conf for private repos)

Packaging & docs:
- Dockerfile (multi-stage distroless), docker-compose.yml, sample config
- README quick start, architecture overview, config reference, security notes
- PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE
- GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64)
- Makefile release target producing static binaries + tarballs + checksums

Tests cover the data-access layer, auth/permission checks, APT index
generation, .deb parsing, GPG signing, the REST API, and the typed API
client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing
a real package.

server/auth/auth.go

@@ -0,0 +1,135 @@
+// Package auth implements identity resolution (bearer/basic) and the
+// repository-scoped permission checks used by the REST API and the APT
+// endpoint.
+package auth
+
+import (
+	"context"
+	"errors"
+	"net/http"
+
+	"urapt/server/store"
+	"urapt/shared/crypto"
+	"urapt/shared/httputil"
+	"urapt/shared/models"
+)
+
+// Identity is the resolved caller: a user and (for REST) the token used.
+type Identity struct {
+	User    *models.User
+	TokenID string
+}
+
+// Service resolves identities and answers permission questions.
+type Service struct {
+	store *store.Store
+}
+
+// NewService constructs an auth Service.
+func NewService(s *store.Store) *Service {
+	return &Service{store: s}
+}
+
+// ErrUnauthenticated is returned when no valid identity can be established.
+var ErrUnauthenticated = errors.New("unauthenticated")
+
+// ResolveBearer resolves an "Authorization: Bearer <token>" header to an
+// identity. Returns ErrUnauthenticated if absent or invalid.
+func (s *Service) ResolveBearer(ctx context.Context, h http.Header) (*Identity, error) {
+	token, ok := httputil.ParseBearer(h)
+	if !ok {
+		return nil, ErrUnauthenticated
+	}
+	return s.resolveToken(ctx, token)
+}
+
+// ResolveBasic resolves an "Authorization: Basic" header where the password is
+// an API token. Returns ErrUnauthenticated if absent/invalid.
+func (s *Service) ResolveBasic(ctx context.Context, h http.Header) (*Identity, error) {
+	_, password, ok := httputil.ParseBasic(h)
+	if !ok {
+		return nil, ErrUnauthenticated
+	}
+	return s.resolveToken(ctx, password)
+}
+
+func (s *Service) resolveToken(ctx context.Context, token string) (*Identity, error) {
+	if token == "" {
+		return nil, ErrUnauthenticated
+	}
+	hash := crypto.HashToken(token)
+	t, err := s.store.GetTokenByHash(ctx, hash)
+	if err != nil {
+		if errors.Is(err, store.ErrNotFound) {
+			return nil, ErrUnauthenticated
+		}
+		return nil, err
+	}
+	user, err := s.store.GetUserByID(ctx, t.UserID)
+	if err != nil {
+		return nil, ErrUnauthenticated
+	}
+	_ = s.store.TouchToken(ctx, t.ID)
+	return &Identity{User: user, TokenID: t.ID}, nil
+}
+
+// CanRead reports whether user may read (download/list within) repo.
+func (s *Service) CanRead(ctx context.Context, user *models.User, repo *models.Repository) (bool, error) {
+	if user == nil {
+		return repo.Visibility == models.VisibilityPublic, nil
+	}
+	if user.IsAdmin || repo.OwnerUserID == user.ID {
+		return true, nil
+	}
+	access, ok, err := s.store.GetMemberAccess(ctx, repo.ID, user.ID)
+	if err != nil {
+		return false, err
+	}
+	if ok {
+		switch access {
+		case models.AccessRead, models.AccessReadWrite, models.AccessAdmin:
+			return true, nil
+		}
+	}
+	return repo.Visibility == models.VisibilityPublic, nil
+}
+
+// CanWrite reports whether user may push packages to repo.
+func (s *Service) CanWrite(ctx context.Context, user *models.User, repo *models.Repository) (bool, error) {
+	if user == nil {
+		return false, nil
+	}
+	if user.IsAdmin || repo.OwnerUserID == user.ID {
+		return true, nil
+	}
+	access, ok, err := s.store.GetMemberAccess(ctx, repo.ID, user.ID)
+	if err != nil {
+		return false, err
+	}
+	if !ok {
+		return false, nil
+	}
+	switch access {
+	case models.AccessWrite, models.AccessReadWrite, models.AccessAdmin:
+		return true, nil
+	}
+	return false, nil
+}
+
+// CanManage reports whether user may manage repo settings and members.
+func (s *Service) CanManage(ctx context.Context, user *models.User, repo *models.Repository) (bool, error) {
+	if user == nil {
+		return false, nil
+	}
+	if user.IsAdmin || repo.OwnerUserID == user.ID {
+		return true, nil
+	}
+	access, ok, err := s.store.GetMemberAccess(ctx, repo.ID, user.ID)
+	if err != nil {
+		return false, err
+	}
+	if !ok {
+		return false, nil
+	}
+	return access == models.AccessAdmin, nil
+}