Initial release: self-hostable APT repository server and CLI

urapt is a self-hostable APT repository server with a companion CLI for
pushing and managing Debian .deb packages.

Server (urapt-server):
- REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO)
- .deb files stored content-addressed on disk, reference-counted for dedup
- Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto)
- APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand
  from the DB, cached in memory, signed with the server key
- Full APT model: repositories -> distributions -> components -> architectures
- Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads
- First registrant becomes admin; repo-scoped permissions
  (read/write/read-write/admin) plus owner and server-admin roles
- Multipart package push with control-field extraction, list/show/delete,
  pool serving, blob ref-count cleanup
- Audit log

CLI (urapt):
- register/login/logout/whoami, token management
- repo/distro/component/arch CRUD, member management
- push/pull/ls/show/rm for packages
- apt-config helper that emits apt setup commands (key, sources.list,
  auth.conf for private repos)

Packaging & docs:
- Dockerfile (multi-stage distroless), docker-compose.yml, sample config
- README quick start, architecture overview, config reference, security notes
- PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE
- GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64)
- Makefile release target producing static binaries + tarballs + checksums

Tests cover the data-access layer, auth/permission checks, APT index
generation, .deb parsing, GPG signing, the REST API, and the typed API
client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing
a real package.

shared/crypto/crypto.go

@@ -0,0 +1,51 @@
+// Package crypto provides password hashing and API token generation utilities
+// shared by the server and (for verification symmetry) tests.
+package crypto
+
+import (
+	"crypto/rand"
+	"crypto/sha256"
+	"encoding/base64"
+	"fmt"
+
+	"golang.org/x/crypto/bcrypt"
+)
+
+// TokenPrefix is the textual prefix attached to all urapt API tokens so they
+// are easy to identify and not confused with other secrets.
+const TokenPrefix = "urapt_"
+
+// HashPassword returns a bcrypt hash of the given plaintext password.
+func HashPassword(password string) (string, error) {
+	h, err := bcrypt.GenerateFromPassword([]byte(password), 12)
+	if err != nil {
+		return "", fmt.Errorf("bcrypt: %w", err)
+	}
+	return string(h), nil
+}
+
+// VerifyPassword reports whether password matches the stored bcrypt hash.
+func VerifyPassword(hash, password string) bool {
+	return bcrypt.CompareHashAndPassword([]byte(hash), []byte(password)) == nil
+}
+
+// GenerateToken creates a new random API token (TokenPrefix + base64url of 32
+// random bytes) and returns it together with its SHA-256 hash (for storage)
+// and an 8-char display prefix.
+func GenerateToken() (token, hash, prefix string, err error) {
+	raw := make([]byte, 32)
+	if _, err = rand.Read(raw); err != nil {
+		return "", "", "", fmt.Errorf("rand: %w", err)
+	}
+	body := base64.RawURLEncoding.EncodeToString(raw)
+	token = TokenPrefix + body
+	hash = HashToken(token)
+	prefix = token[:len(TokenPrefix)+8]
+	return token, hash, prefix, nil
+}
+
+// HashToken returns the SHA-256 hex digest of a token, for storage/lookup.
+func HashToken(token string) string {
+	sum := sha256.Sum256([]byte(token))
+	return fmt.Sprintf("%x", sum)
+}

shared/crypto/crypto_test.go

@@ -0,0 +1,43 @@
+package crypto
+
+import "testing"
+
+func TestHashAndVerifyPassword(t *testing.T) {
+	h, err := HashPassword("hunter2")
+	if err != nil {
+		t.Fatalf("HashPassword: %v", err)
+	}
+	if !VerifyPassword(h, "hunter2") {
+		t.Fatal("expected verify to pass for correct password")
+	}
+	if VerifyPassword(h, "wrong") {
+		t.Fatal("expected verify to fail for wrong password")
+	}
+}
+
+func TestGenerateToken(t *testing.T) {
+	tok, hash, prefix, err := GenerateToken()
+	if err != nil {
+		t.Fatalf("GenerateToken: %v", err)
+	}
+	if tok == "" || hash == "" || prefix == "" {
+		t.Fatal("empty token fields")
+	}
+	if len(tok) <= len(TokenPrefix) {
+		t.Fatal("token too short")
+	}
+	if tok[:len(TokenPrefix)] != TokenPrefix {
+		t.Fatalf("token missing prefix: %q", tok)
+	}
+	if HashToken(tok) != hash {
+		t.Fatal("HashToken does not match returned hash")
+	}
+	if prefix != tok[:len(TokenPrefix)+8] {
+		t.Fatalf("prefix %q != expected", prefix)
+	}
+
+	tok2, _, _, _ := GenerateToken()
+	if tok == tok2 {
+		t.Fatal("expected distinct tokens")
+	}
+}