Initial release: self-hostable APT repository server and CLI

urapt is a self-hostable APT repository server with a companion CLI for
pushing and managing Debian .deb packages.

Server (urapt-server):
- REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO)
- .deb files stored content-addressed on disk, reference-counted for dedup
- Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto)
- APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand
  from the DB, cached in memory, signed with the server key
- Full APT model: repositories -> distributions -> components -> architectures
- Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads
- First registrant becomes admin; repo-scoped permissions
  (read/write/read-write/admin) plus owner and server-admin roles
- Multipart package push with control-field extraction, list/show/delete,
  pool serving, blob ref-count cleanup
- Audit log

CLI (urapt):
- register/login/logout/whoami, token management
- repo/distro/component/arch CRUD, member management
- push/pull/ls/show/rm for packages
- apt-config helper that emits apt setup commands (key, sources.list,
  auth.conf for private repos)

Packaging & docs:
- Dockerfile (multi-stage distroless), docker-compose.yml, sample config
- README quick start, architecture overview, config reference, security notes
- PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE
- GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64)
- Makefile release target producing static binaries + tarballs + checksums

Tests cover the data-access layer, auth/permission checks, APT index
generation, .deb parsing, GPG signing, the REST API, and the typed API
client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing
a real package.

server/store/repos.go

@@ -0,0 +1,125 @@
+package store
+
+import (
+	"context"
+	"database/sql"
+	"fmt"
+
+	"urapt/shared/models"
+)
+
+// CreateRepository inserts a new repository owned by userID.
+func (s *Store) CreateRepository(ctx context.Context, name, ownerUserID string, visibility models.Visibility, description string) (*models.Repository, error) {
+	id := newID()
+	now := s.now()
+	_, err := s.exec(ctx, `INSERT INTO repositories (id, name, owner_user_id, visibility, description, created_at, updated_at)
+		VALUES (?, ?, ?, ?, ?, ?, ?)`, id, name, ownerUserID, string(visibility), description, now, now)
+	if err != nil {
+		return nil, fmt.Errorf("insert repository: %w", err)
+	}
+	return &models.Repository{
+		ID: id, Name: name, OwnerUserID: ownerUserID, Visibility: visibility,
+		Description: description, CreatedAt: now, UpdatedAt: now,
+	}, nil
+}
+
+// ListReposVisible returns repositories visible to userID: owned, public, or
+// where the user is a member.
+func (s *Store) ListReposVisible(ctx context.Context, userID string) ([]*models.Repository, error) {
+	rows, err := s.db.QueryContext(ctx, `
+		SELECT DISTINCT r.id, r.name, r.owner_user_id, r.visibility, r.description, r.created_at, r.updated_at
+		FROM repositories r
+		WHERE r.owner_user_id = ?
+		   OR r.visibility = 'public'
+		   OR EXISTS (SELECT 1 FROM repository_members m WHERE m.repository_id = r.id AND m.user_id = ?)
+		ORDER BY r.name`, userID, userID)
+	if err != nil {
+		return nil, fmt.Errorf("list repos: %w", err)
+	}
+	defer rows.Close()
+	var out []*models.Repository
+	for rows.Next() {
+		r := &models.Repository{}
+		if err := rows.Scan(&r.ID, &r.Name, &r.OwnerUserID, &r.Visibility, &r.Description, &r.CreatedAt, &r.UpdatedAt); err != nil {
+			return nil, err
+		}
+		out = append(out, r)
+	}
+	return out, rows.Err()
+}
+
+// UpdateRepository mutates a repository's name, visibility, and description.
+// Empty strings leave the field unchanged.
+func (s *Store) UpdateRepository(ctx context.Context, id, name string, visibility *models.Visibility, description *string) error {
+	now := s.now()
+	if name != "" {
+		if _, err := s.exec(ctx, `UPDATE repositories SET name = ?, updated_at = ? WHERE id = ?`, name, now, id); err != nil {
+			return fmt.Errorf("update repo name: %w", err)
+		}
+	}
+	if visibility != nil {
+		if _, err := s.exec(ctx, `UPDATE repositories SET visibility = ?, updated_at = ? WHERE id = ?`, string(*visibility), now, id); err != nil {
+			return fmt.Errorf("update repo visibility: %w", err)
+		}
+	}
+	if description != nil {
+		if _, err := s.exec(ctx, `UPDATE repositories SET description = ?, updated_at = ? WHERE id = ?`, *description, now, id); err != nil {
+			return fmt.Errorf("update repo description: %w", err)
+		}
+	}
+	return nil
+}
+
+// DeleteRepository deletes a repository and all its child rows (cascade).
+// The caller must have already handled blob ref-count cleanup.
+func (s *Store) DeleteRepository(ctx context.Context, id string) error {
+	if _, err := s.exec(ctx, `DELETE FROM repositories WHERE id = ?`, id); err != nil {
+		return fmt.Errorf("delete repository: %w", err)
+	}
+	return nil
+}
+
+// GetRepositoryByName returns a repository by its unique name.
+func (s *Store) GetRepositoryByName(ctx context.Context, name string) (*models.Repository, error) {
+	row := s.db.QueryRowContext(ctx,
+		`SELECT id, name, owner_user_id, visibility, description, created_at, updated_at
+		 FROM repositories WHERE name = ?`, name)
+	return scanRepo(row)
+}
+
+// GetRepositoryByID returns a repository by id.
+func (s *Store) GetRepositoryByID(ctx context.Context, id string) (*models.Repository, error) {
+	row := s.db.QueryRowContext(ctx,
+		`SELECT id, name, owner_user_id, visibility, description, created_at, updated_at
+		 FROM repositories WHERE id = ?`, id)
+	return scanRepo(row)
+}
+
+func scanRepo(row *sql.Row) (*models.Repository, error) {
+	r := &models.Repository{}
+	err := row.Scan(&r.ID, &r.Name, &r.OwnerUserID, &r.Visibility, &r.Description, &r.CreatedAt, &r.UpdatedAt)
+	if isErrNoRows(err) {
+		return nil, ErrNotFound
+	}
+	if err != nil {
+		return nil, err
+	}
+	return r, nil
+}
+
+// GetMemberAccess returns the access level granted to userID on repoID, or
+// ("", false) if the user is not an explicit member.
+func (s *Store) GetMemberAccess(ctx context.Context, repoID, userID string) (models.Access, bool, error) {
+	row := s.db.QueryRowContext(ctx,
+		`SELECT access FROM repository_members WHERE repository_id = ? AND user_id = ?`,
+		repoID, userID)
+	var access string
+	err := row.Scan(&access)
+	if isErrNoRows(err) {
+		return "", false, nil
+	}
+	if err != nil {
+		return "", false, fmt.Errorf("get member access: %w", err)
+	}
+	return models.Access(access), true, nil
+}