Initial release: self-hostable APT repository server and CLI

urapt is a self-hostable APT repository server with a companion CLI for
pushing and managing Debian .deb packages.

Server (urapt-server):
- REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO)
- .deb files stored content-addressed on disk, reference-counted for dedup
- Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto)
- APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand
  from the DB, cached in memory, signed with the server key
- Full APT model: repositories -> distributions -> components -> architectures
- Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads
- First registrant becomes admin; repo-scoped permissions
  (read/write/read-write/admin) plus owner and server-admin roles
- Multipart package push with control-field extraction, list/show/delete,
  pool serving, blob ref-count cleanup
- Audit log

CLI (urapt):
- register/login/logout/whoami, token management
- repo/distro/component/arch CRUD, member management
- push/pull/ls/show/rm for packages
- apt-config helper that emits apt setup commands (key, sources.list,
  auth.conf for private repos)

Packaging & docs:
- Dockerfile (multi-stage distroless), docker-compose.yml, sample config
- README quick start, architecture overview, config reference, security notes
- PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE
- GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64)
- Makefile release target producing static binaries + tarballs + checksums

Tests cover the data-access layer, auth/permission checks, APT index
generation, .deb parsing, GPG signing, the REST API, and the typed API
client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing
a real package.

server/store/members.go

@@ -0,0 +1,76 @@
+package store
+
+import (
+	"context"
+	"fmt"
+
+	"urapt/shared/models"
+)
+
+// AddMember grants a user access on a repository. If a grant already exists it
+// is updated.
+func (s *Store) AddMember(ctx context.Context, repoID, userID string, access models.Access) error {
+	now := s.now()
+	_, err := s.exec(ctx, `INSERT INTO repository_members (repository_id, user_id, access, created_at)
+		VALUES (?, ?, ?, ?)
+		ON CONFLICT(repository_id, user_id) DO UPDATE SET access = excluded.access`,
+		repoID, userID, string(access), now)
+	if err != nil {
+		return fmt.Errorf("upsert member: %w", err)
+	}
+	return nil
+}
+
+// UpdateMemberAccess changes a user's access on a repository.
+func (s *Store) UpdateMemberAccess(ctx context.Context, repoID, userID string, access models.Access) error {
+	res, err := s.exec(ctx, `UPDATE repository_members SET access = ? WHERE repository_id = ? AND user_id = ?`,
+		string(access), repoID, userID)
+	if err != nil {
+		return fmt.Errorf("update member: %w", err)
+	}
+	n, _ := res.RowsAffected()
+	if n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+// RemoveMember revokes a user's access on a repository.
+func (s *Store) RemoveMember(ctx context.Context, repoID, userID string) error {
+	res, err := s.exec(ctx, `DELETE FROM repository_members WHERE repository_id = ? AND user_id = ?`, repoID, userID)
+	if err != nil {
+		return fmt.Errorf("remove member: %w", err)
+	}
+	n, _ := res.RowsAffected()
+	if n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
+// ListMembers returns all members of a repository with their user records.
+func (s *Store) ListMembers(ctx context.Context, repoID string) ([]*models.RepositoryMember, error) {
+	rows, err := s.db.QueryContext(ctx, `
+		SELECT m.repository_id, m.user_id, m.access, m.created_at,
+		       u.id, u.username, u.is_admin, u.created_at, u.updated_at
+		FROM repository_members m
+		JOIN users u ON u.id = m.user_id
+		WHERE m.repository_id = ?
+		ORDER BY u.username`, repoID)
+	if err != nil {
+		return nil, fmt.Errorf("list members: %w", err)
+	}
+	defer rows.Close()
+	var out []*models.RepositoryMember
+	for rows.Next() {
+		m := &models.RepositoryMember{User: &models.User{}}
+		if err := rows.Scan(
+			&m.RepositoryID, &m.UserID, &m.Access, &m.CreatedAt,
+			&m.User.ID, &m.User.Username, &m.User.IsAdmin, &m.User.CreatedAt, &m.User.UpdatedAt,
+		); err != nil {
+			return nil, err
+		}
+		out = append(out, m)
+	}
+	return out, rows.Err()
+}