remoteapi: authz interceptors, remotesrv assembly, credentials service

browse: read-only doltdb browsing over bare stores

Read-only web-browsing data layer over bare NBS chunk stores, the only
package that reaches into version-fragile dolthub/dolt internals (nbs,
prolly, durable, diff), kept isolated so a module bump re-verifies here.

- open.go: Open/Close per request. Builds the DoltDB from a single
  nbs.NewLocalStore via doltdb.DoltDBFromCS instead of doltdb.LoadDoltDB:
  LoadDoltDB's GenerationalNBS wrapper panics on Close over our bare
  stores in the pinned version (onHeapTableIndex ref count < 0), even on
  a plain open-then-close. The single-store path closes cleanly, gives a
  fresh manifest per request, and is safe alongside the push writer.
- log.go: Branches (+ DefaultBranch pick), Log with topological walk,
  count+start-hash pagination, and commit metadata.
- tables.go: Tables (schema + cheap row count) and Rows via
  durable.ProllyMapFromIndex + prolly IterOrdinalRange, rendered through
  the tuple descriptors; NULLs, binary/out-of-band values and exotic
  encodings degrade to printable placeholders and never panic.
- diff.go: CommitSummary vs first parent (empty root for the initial
  commit) with exact added/removed/modified row counts from
  diff.StatForTableDelta.
- tests: fixture built the production way (WriteEmptyRepo bare store, CLI
  clone/commit/push over a file:// remote); covers branches, log
  pagination/topo order, tables/schema, row pagination incl. empty table,
  commit summaries across the add/insert/modify chain and the initial
  commit, and nonexistent ref/table errors.

authn: cookie, PAT, and dolt-JWT caller resolution

Add the authn package resolving the SourceHut caller across dolt.sr.ht's
three auth flows, producing core-go *auth.AuthContext values mapped onto the
pure core.Caller domain type:

- ctx.go: WithCaller/CallerFromContext (nil for anonymous, never panics) and
  AsCoreCaller (maps UserType, derives Suspended).
- cookie.go: OptionalCookieMiddleware, the never-rejecting unified-login
  cookie reader (fernet decrypt -> {name} -> LookupUser); any failure degrades
  to anonymous so public browsing keeps working.
- token.go: ResolveBasic, the meta personal-access-token trio (offline
  DecodeBearerToken -> username match -> LookupUser + revocation) with a 60s
  positive cache keyed by sha512(password); TokenGrantsAllow gates
  dolt.sr.ht/repos RO/RW grants (empty grants pass).
- jwt.go: ResolveDoltJWT, EdDSA JWS verification for dolt keypair auth (kid ->
  KeyStore pubkey, alg=EdDSA, aud/exp/sub checked, iss ignored), reusing
  dolt's creds.PubKeyToKIDStr for the kid<->pubkey integrity check.
- grpc.go: ResolveGRPCAuth dispatching Basic/Bearer/anonymous.

Meta lookup + revocation sit behind the MetaBackend interface and JWT keys
behind the KeyStore interface (implemented later by db/), so tests forge
cookies (fernet), PATs (BearerToken.Encode) and real Ed25519 JWTs against
in-memory stubs with no network or Postgres.

db: postgres layer for repos, ACLs, dolt keys

Store wraps a Querier (*sql.DB/*sql.Tx/*sql.Conn); context-first methods, FromContext for core-go middleware, WithTx for the create-repo transaction. Repo CRUD + listing-visibility rules, effective-access/ACL upsert, dolt_key CRUD with typed ErrNotFound/ErrNameTaken/ErrKeyExists. Tests gated on DOLTSRHT_TEST_PG: per-run scratch schema + schema.sql, CRUD/visibility/effective-access cases; skip when unset.

storage: bare store init/delete and remotesrv DBCache

InitStore writes a bare NBS store (LoadDoltDB Format_DOLT + WriteEmptyRepo)
with partial-failure cleanup; DeleteStore guards against paths escaping the
configured repos root; RepoDiskPath lays out <root>/~<owner>/<name>.

Cache implements remotesrv.DBCache over an injected RepoLookup (no db import,
no push-to-create): Get resolves via core.ParseRepoPath, memoizes one
nbs.NewLocalStore per disk path, never creates directories; Evict/Close for
delete and shutdown. Package doc records the LocalFilesysWithWorkingDir
sealed-URL requirement proven by the Phase-0 spike.

Unit tests cover store validity (reopen, main branch, initial commit),
partial-failure cleanup, root-escape guard, and cache hit/miss/memoize/evict.
Spike test untouched and still green.

foundation: module, core domain, schema, spike-verified dolt interop

Phase 0 foundation for dolt.sr.ht (pure-Go Dolt hosting for SourceHut).

Dependency pins:
- core-go v0.0.0-20260520082310-fdb3662452dc: the production instance's
  submodule commit (fdb3662); must never be upgraded so token/config/crypto
  behavior matches the rest of the instance.
- dolthub/dolt/go v0.40.5-0.20260626152440-45335d44ad79: pseudo-version at the
  commit tagged v2.1.10 (45335d44), matching the installed dolt CLI. The /go
  submodule's latest tag (v0.40.4, 2021) does not interop with a modern CLI;
  matching the CLI commit guarantees a common NBS format (Format_DOLT) and
  remotesapi proto.
- gopkg.in/go-jose/go-jose.v2 v2.6.3: same JOSE version dolt's creds package
  signs EdDSA keypair JWTs with, avoiding a duplicate JOSE lib.
- grpc v1.79.3, logrus v1.8.3, lib/pq v1.10.9, chi/v5 v5.3.1, brant v0.5.1.

Contents:
- core/ pure domain: models, ValidateName/ParseRepoPath, the access matrix
  (Allowed + NotFoundForPrivate), full table-driven tests.
- schema.sql + migrations/0001_initial.sql (brant format).
- config.example.ini, contrib/dolt.sr.ht.conf (nginx), Makefile, scss/main.scss,
  static/logo.svg, README, .gitignore.
- internal/smoke: throwaway import-and-build check (deleted in Phase 3).

Spike (storage/spike_test.go, tag `spike`): bare NBS store via WriteEmptyRepo,
served by remotesrv on an ephemeral single port, round-tripped through the real
dolt CLI v2.1.10 (clone -> insert -> commit -> push -> re-clone -> verify rows).
Green, no version juggling needed beyond selecting the v2.1.10 commit. FS must
be rooted at the repos dir (LocalFilesysWithWorkingDir) so sealed chunk-URL
prefixes are clean relatives.

Build note: dolt pulls go-icu-regex (CGO), which needs ICU4C headers; on this
Mac set CGO_CPPFLAGS/CGO_LDFLAGS to icu4c@78 (documented in README).