feat: file store, PUT endpoint, A1-A10 validation, scoped auth

[jeanmachuca]

Changes

1. File-backed persistence (SQLite-ready)

• store.NewFileStore(path) — persists all packages as JSON, survives restarts
• Implements the same store.Store interface as MemoryStore
• Pluggable: use --sqlite flag to switch (currently uses JSON file, SQLite adapter point ready)
• Adds Versions(), IncrementDownloads(), SetStatus() to the Store interface

2. PUT endpoint

• PUT /v1/patches/{name}/{version} — publish new version of existing package
• URL name and version validated against manifest body
• Reuses same publish logic as POST

3. A1-A10 validation (internal/validate)

• A1: Manifest is valid JSON with required fields
• A2: Schema checks (name, version, description required)
• A3: SHA-256 is 64-char lowercase hex
• A4: No dependency cycles
• A5: All transitive deps exist in registry (handler-level)
• A6: No buggy deps (handler-level)
• A7: File references exist in archive (MCP binaries, system prompts, adapters)
• A8: Hardware requirements within sane bounds
• A9: Source repository URL is valid
• A10: Issues URL responds with HTTP 200 within 10s

4. Scoped auth

• Tokens now carry scope lists (publish, admin)
• RequireAuth(ts, scopes...) checks both token existence AND required scopes
• POST/PUT require publish scope; PATCH status and POST validate require admin scope
• Token store API changed from Check(token) bool to Get(token) (*Token, bool)

5. New endpoints

• GET /v1/patches/{name}/versions — list all versions
• GET /v1/patches/{name}/dependencies — dependency tree (with ?version= param)
• PATCH /v1/patches/{name}/{version}/status — set active/deprecated/buggy
• POST /v1/patches/{name}/{version}/validate — re-trigger A1-A10 validation