Batch A: blob storage layer, MCIAS auth, OCI token endpoint

Phase 2 — internal/storage/:
Content-addressed blob storage with atomic writes via rename.
BlobWriter stages data in uploads dir with running SHA-256 hash,
commits by verifying digest then renaming to layers/sha256/<prefix>/<hex>.
Reader provides Open, Stat, Delete, Exists with digest validation.

Phase 3 — internal/auth/ + internal/server/:
MCIAS client with Login and ValidateToken, 30s SHA-256-keyed cache
with lazy eviction and injectable clock for testing. TLS 1.3 minimum
with optional custom CA cert.
Chi router with RequireAuth middleware (Bearer token extraction,
WWW-Authenticate header, OCI error format), token endpoint (Basic
auth → bearer exchange via MCIAS), and /v2/ version check handler.

52 tests passing (14 storage + 9 auth + 9 server + 20 existing).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/storage/reader.go

@@ -0,0 +1,75 @@
+package storage
+
+import (
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+)
+
+// Open validates the digest and returns a ReadCloser for the blob.
+// Returns ErrBlobNotFound if the blob does not exist on disk.
+func (s *Store) Open(digest string) (io.ReadCloser, error) {
+	if err := validateDigest(digest); err != nil {
+		return nil, err
+	}
+
+	f, err := os.Open(s.blobPath(digest))
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return nil, ErrBlobNotFound
+		}
+		return nil, fmt.Errorf("storage: open blob: %w", err)
+	}
+	return f, nil
+}
+
+// Stat returns the size of the blob in bytes.
+// Returns ErrBlobNotFound if the blob does not exist on disk.
+func (s *Store) Stat(digest string) (int64, error) {
+	if err := validateDigest(digest); err != nil {
+		return 0, err
+	}
+
+	info, err := os.Stat(s.blobPath(digest))
+	if err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return 0, ErrBlobNotFound
+		}
+		return 0, fmt.Errorf("storage: stat blob: %w", err)
+	}
+	return info.Size(), nil
+}
+
+// Delete removes the blob file and attempts to clean up its prefix
+// directory. Non-empty or already-removed prefix directories are
+// silently ignored.
+func (s *Store) Delete(digest string) error {
+	if err := validateDigest(digest); err != nil {
+		return err
+	}
+
+	path := s.blobPath(digest)
+	if err := os.Remove(path); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return ErrBlobNotFound
+		}
+		return fmt.Errorf("storage: delete blob: %w", err)
+	}
+
+	// Best-effort cleanup of the prefix directory.
+	_ = os.Remove(filepath.Dir(path))
+
+	return nil
+}
+
+// Exists reports whether the blob exists on disk.
+func (s *Store) Exists(digest string) bool {
+	if err := validateDigest(digest); err != nil {
+		return false
+	}
+
+	_, err := os.Stat(s.blobPath(digest))
+	return err == nil
+}