Batch A: blob storage layer, MCIAS auth, OCI token endpoint

Phase 2 — internal/storage/:
Content-addressed blob storage with atomic writes via rename.
BlobWriter stages data in uploads dir with running SHA-256 hash,
commits by verifying digest then renaming to layers/sha256/<prefix>/<hex>.
Reader provides Open, Stat, Delete, Exists with digest validation.

Phase 3 — internal/auth/ + internal/server/:
MCIAS client with Login and ValidateToken, 30s SHA-256-keyed cache
with lazy eviction and injectable clock for testing. TLS 1.3 minimum
with optional custom CA cert.
Chi router with RequireAuth middleware (Bearer token extraction,
WWW-Authenticate header, OCI error format), token endpoint (Basic
auth → bearer exchange via MCIAS), and /v2/ version check handler.

52 tests passing (14 storage + 9 auth + 9 server + 20 existing).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/storage/reader_test.go

@@ -0,0 +1,107 @@
+package storage
+
+import (
+	"errors"
+	"io"
+	"testing"
+)
+
+func TestOpenAfterWrite(t *testing.T) {
+	s := newTestStore(t)
+	data := []byte("readable blob content")
+	digest := writeTestBlob(t, s, data)
+
+	rc, err := s.Open(digest)
+	if err != nil {
+		t.Fatalf("Open: %v", err)
+	}
+	defer func() { _ = rc.Close() }()
+
+	got, err := io.ReadAll(rc)
+	if err != nil {
+		t.Fatalf("ReadAll: %v", err)
+	}
+	if string(got) != string(data) {
+		t.Fatalf("Open content: got %q, want %q", got, data)
+	}
+}
+
+func TestStatAfterWrite(t *testing.T) {
+	s := newTestStore(t)
+	data := []byte("stat this blob")
+	digest := writeTestBlob(t, s, data)
+
+	size, err := s.Stat(digest)
+	if err != nil {
+		t.Fatalf("Stat: %v", err)
+	}
+	if size != int64(len(data)) {
+		t.Fatalf("Stat size: got %d, want %d", size, len(data))
+	}
+}
+
+func TestExists(t *testing.T) {
+	s := newTestStore(t)
+	data := []byte("existence check")
+	digest := writeTestBlob(t, s, data)
+
+	if !s.Exists(digest) {
+		t.Fatal("Exists returned false for written blob")
+	}
+
+	nonexistent := "sha256:0000000000000000000000000000000000000000000000000000000000000000"
+	if s.Exists(nonexistent) {
+		t.Fatal("Exists returned true for nonexistent blob")
+	}
+}
+
+func TestDelete(t *testing.T) {
+	s := newTestStore(t)
+	data := []byte("delete me")
+	digest := writeTestBlob(t, s, data)
+
+	if err := s.Delete(digest); err != nil {
+		t.Fatalf("Delete: %v", err)
+	}
+
+	if s.Exists(digest) {
+		t.Fatal("Exists returned true after Delete")
+	}
+
+	_, err := s.Open(digest)
+	if !errors.Is(err, ErrBlobNotFound) {
+		t.Fatalf("Open after Delete: got %v, want ErrBlobNotFound", err)
+	}
+}
+
+func TestOpenNotFound(t *testing.T) {
+	s := newTestStore(t)
+
+	digest := "sha256:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
+	_, err := s.Open(digest)
+	if !errors.Is(err, ErrBlobNotFound) {
+		t.Fatalf("Open nonexistent: got %v, want ErrBlobNotFound", err)
+	}
+}
+
+func TestInvalidDigestFormat(t *testing.T) {
+	s := newTestStore(t)
+	bad := "not-a-digest"
+
+	if _, err := s.Open(bad); !errors.Is(err, ErrInvalidDigest) {
+		t.Fatalf("Open with bad digest: got %v, want ErrInvalidDigest", err)
+	}
+
+	if _, err := s.Stat(bad); !errors.Is(err, ErrInvalidDigest) {
+		t.Fatalf("Stat with bad digest: got %v, want ErrInvalidDigest", err)
+	}
+
+	if err := s.Delete(bad); !errors.Is(err, ErrInvalidDigest) {
+		t.Fatalf("Delete with bad digest: got %v, want ErrInvalidDigest", err)
+	}
+
+	// Exists should return false for an invalid digest, not panic.
+	if s.Exists(bad) {
+		t.Fatal("Exists returned true for invalid digest")
+	}
+}