Initial release: self-hostable APT repository server and CLI

urapt is a self-hostable APT repository server with a companion CLI for
pushing and managing Debian .deb packages.

Server (urapt-server):
- REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO)
- .deb files stored content-addressed on disk, reference-counted for dedup
- Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto)
- APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand
  from the DB, cached in memory, signed with the server key
- Full APT model: repositories -> distributions -> components -> architectures
- Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads
- First registrant becomes admin; repo-scoped permissions
  (read/write/read-write/admin) plus owner and server-admin roles
- Multipart package push with control-field extraction, list/show/delete,
  pool serving, blob ref-count cleanup
- Audit log

CLI (urapt):
- register/login/logout/whoami, token management
- repo/distro/component/arch CRUD, member management
- push/pull/ls/show/rm for packages
- apt-config helper that emits apt setup commands (key, sources.list,
  auth.conf for private repos)

Packaging & docs:
- Dockerfile (multi-stage distroless), docker-compose.yml, sample config
- README quick start, architecture overview, config reference, security notes
- PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE
- GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64)
- Makefile release target producing static binaries + tarballs + checksums

Tests cover the data-access layer, auth/permission checks, APT index
generation, .deb parsing, GPG signing, the REST API, and the typed API
client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing
a real package.

server/cache/cache.go

@@ -0,0 +1,79 @@
+// Package cache defines the in-memory APT index cache contract used by the
+// REST API (to invalidate on mutation) and the APT endpoint (to serve cached
+// indices). The implementation lives in this package; it is regenerated lazily
+// after invalidation or restart.
+package cache
+
+import (
+	"sync"
+
+	"urapt/shared/apt"
+)
+
+// IndexCache holds generated APT indices per (repository, suite), keyed and
+// versioned so that mutations invalidate lazily.
+type IndexCache struct {
+	mu    sync.Mutex
+	entry map[string]*entry
+}
+
+type entry struct {
+	indices *apt.Indices
+	suite   *apt.Suite
+	gen     int64
+	dirty   bool
+}
+
+// New constructs an empty IndexCache.
+func New() *IndexCache {
+	return &IndexCache{entry: map[string]*entry{}}
+}
+
+// key builds the cache key.
+func key(repoID, suite string) string { return repoID + "/" + suite }
+
+// Get returns the cached indices for (repoID, suite), or nil if not present
+// or marked dirty. The suite is returned so the caller can rebuild it.
+func (c *IndexCache) Get(repoID, suite string) *apt.Indices {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	e := c.entry[key(repoID, suite)]
+	if e == nil || e.dirty {
+		return nil
+	}
+	return e.indices
+}
+
+// Put stores freshly generated indices for (repoID, suite).
+func (c *IndexCache) Put(repoID, suite string, idx *apt.Indices) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	e := c.entry[key(repoID, suite)]
+	if e == nil {
+		e = &entry{}
+		c.entry[key(repoID, suite)] = e
+	}
+	e.indices = idx
+	e.dirty = false
+}
+
+// Invalidate marks one (repository, suite) as stale; the next read rebuilds.
+func (c *IndexCache) Invalidate(repoID, suite string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	if e := c.entry[key(repoID, suite)]; e != nil {
+		e.dirty = true
+	}
+}
+
+// InvalidateRepo marks every suite under a repository as stale.
+func (c *IndexCache) InvalidateRepo(repoID string) {
+	c.mu.Lock()
+	defer c.mu.Unlock()
+	prefix := repoID + "/"
+	for k, e := range c.entry {
+		if len(k) > len(prefix) && k[:len(prefix)] == prefix {
+			e.dirty = true
+		}
+	}
+}