Initial release: self-hostable APT repository server and CLI

urapt is a self-hostable APT repository server with a companion CLI for
pushing and managing Debian .deb packages.

Server (urapt-server):
- REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO)
- .deb files stored content-addressed on disk, reference-counted for dedup
- Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto)
- APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand
  from the DB, cached in memory, signed with the server key
- Full APT model: repositories -> distributions -> components -> architectures
- Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads
- First registrant becomes admin; repo-scoped permissions
  (read/write/read-write/admin) plus owner and server-admin roles
- Multipart package push with control-field extraction, list/show/delete,
  pool serving, blob ref-count cleanup
- Audit log

CLI (urapt):
- register/login/logout/whoami, token management
- repo/distro/component/arch CRUD, member management
- push/pull/ls/show/rm for packages
- apt-config helper that emits apt setup commands (key, sources.list,
  auth.conf for private repos)

Packaging & docs:
- Dockerfile (multi-stage distroless), docker-compose.yml, sample config
- README quick start, architecture overview, config reference, security notes
- PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE
- GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64)
- Makefile release target producing static binaries + tarballs + checksums

Tests cover the data-access layer, auth/permission checks, APT index
generation, .deb parsing, GPG signing, the REST API, and the typed API
client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing
a real package.

server/middleware/middleware.go

@@ -0,0 +1,107 @@
+// Package middleware provides HTTP middleware shared by the REST API and the
+// APT endpoint: panic recovery, request logging, and bearer/basic identity
+// injection.
+package middleware
+
+import (
+	"context"
+	"log/slog"
+	"net/http"
+	"runtime/debug"
+
+	"urapt/server/auth"
+	"urapt/shared/httputil"
+)
+
+// ctxKey is an unexported key type for context values.
+type ctxKey int
+
+const (
+	keyIdentity ctxKey = iota
+)
+
+// IdentityFromContext returns the identity previously attached by RequireBearer
+// or OptionalBearer, or nil.
+func IdentityFromContext(ctx context.Context) *auth.Identity {
+	v, _ := ctx.Value(keyIdentity).(*auth.Identity)
+	return v
+}
+
+// withIdentity stores id in the context.
+func withIdentity(ctx context.Context, id *auth.Identity) context.Context {
+	return context.WithValue(ctx, keyIdentity, id)
+}
+
+// Recover catches panics and renders a uniform 500.
+func Recover(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		defer func() {
+			if rec := recover(); rec != nil {
+				slog.Error("panic", "err", rec, "stack", string(debug.Stack()))
+				httputil.WriteError(w, http.StatusInternalServerError, httputil.CodeInternal, "internal server error")
+			}
+		}()
+		next.ServeHTTP(w, r)
+	})
+}
+
+// Log logs each request using slog.
+func Log(next http.Handler) http.Handler {
+	return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		rw := &statusRecorder{ResponseWriter: w, status: http.StatusOK}
+		next.ServeHTTP(rw, r)
+		slog.Info("http", "method", r.Method, "path", r.URL.Path, "status", rw.status)
+	})
+}
+
+type statusRecorder struct {
+	http.ResponseWriter
+	status int
+}
+
+func (s *statusRecorder) WriteHeader(code int) {
+	s.status = code
+	s.ResponseWriter.WriteHeader(code)
+}
+
+// RequireBearer resolves a bearer token; on failure it renders 401. On success
+// the identity is attached to the request context.
+func RequireBearer(svc *auth.Service) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			id, err := svc.ResolveBearer(r.Context(), r.Header)
+			if err != nil {
+				httputil.WriteError(w, http.StatusUnauthorized, httputil.CodeUnauthorized, "authentication required")
+				return
+			}
+			next.ServeHTTP(w, r.WithContext(withIdentity(r.Context(), id)))
+		})
+	}
+}
+
+// OptionalBearer resolves a bearer token if present but never blocks; the
+// identity (possibly nil) is attached to the context.
+func OptionalBearer(svc *auth.Service) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			id, _ := svc.ResolveBearer(r.Context(), r.Header)
+			next.ServeHTTP(w, r.WithContext(withIdentity(r.Context(), id)))
+		})
+	}
+}
+
+// RequireBasic resolves HTTP Basic auth (password = API token); on failure it
+// issues a 401 with a WWW-Authenticate challenge. Used by the APT endpoint for
+// private repositories.
+func RequireBasic(svc *auth.Service, realm string) func(http.Handler) http.Handler {
+	return func(next http.Handler) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			id, err := svc.ResolveBasic(r.Context(), r.Header)
+			if err != nil {
+				httputil.ChallengeBasic(w, realm)
+				return
+			}
+			next.ServeHTTP(w, r.WithContext(withIdentity(r.Context(), id)))
+		})
+	}
+}