[joshhalley]

Description

Adds authenticated registry delivery support for Docker HTTP Passthrough so Cisco IOS-XE devices can download Docker save-compatible archives from Docker Hub, GHCR, and private registries.

This includes:

• Request-selected registry routes with /registry/{scheme}/{host}/docker/{filename} and /registry-auth/{scheme}/{host}/docker/{filename}.
• Per-request client Basic auth so Cisco ip http client username and ip http client password can supply registry credentials without storing them in the passthrough container.
• Docker Hub alias handling, GHCR path encoding guidance, bearer challenge discovery, direct Basic auth, and static token support.
• Prepared-response and tar assembly improvements so registry failures are reported before a successful archive response is committed.
• Expanded OpenTelemetry instrumentation for request parsing, auth decisions, registry calls, tar preparation, and streaming.
• Multi-arch OCI image build and publish artifacts for GHCR.
• Dynamic project website and Zensical documentation with Mermaid diagrams, validation notes, and third-party licensing notices.

No linked issue identified.

Technical references:

• Docker Registry HTTP API V2 behavior for manifests, blobs, and auth challenges.
• OpenTelemetry semantic conventions for HTTP, network, and container image attributes.
• Mermaid and Zensical attribution is recorded in NOTICE.

Type of Change

• Bug Fix
• New Feature
• Breaking Change
• Refactor
• Documentation
• Other (CI, multi-arch container publishing, website, and licensing updates)

Checklist

• I have read the contributing guidelines
• Existing issues have been referenced (where applicable; no linked issue identified)
• I have verified this change is not present in other open pull requests
• Functionality is documented
• All code style checks pass (cargo fmt -- --check, git diff --check HEAD)
• New code contribution is covered by automated tests
• All new and existing tests pass (cargo test)

Additional validation performed:

• zensical build
• docker compose config
• docker buildx bake --print image-all
• Local browser verification for dynamic website and Zensical documentation pages

[moskrive]

LGTM