Phase 7: OCI delete path for manifests and blobs

Manifest delete (DELETE /v2/<name>/manifests/<digest>): rejects tag
references with 405 UNSUPPORTED per OCI spec, cascades to tags and
manifest_blobs via ON DELETE CASCADE, returns 202 Accepted.

Blob delete (DELETE /v2/<name>/blobs/<digest>): removes manifest_blobs
associations only — blob row and file are preserved for GC to handle,
since other repos may reference the same content-addressed blob.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/oci/handler.go

@@ -31,6 +31,10 @@ type DBQuerier interface {
 	GetUpload(uuid string) (*db.UploadRow, error)
 	UpdateUploadOffset(uuid string, offset int64) error
 	DeleteUpload(uuid string) error
+
+	// Delete operations
+	DeleteManifest(repoID int64, digest string) error
+	DeleteBlobFromRepo(repoID int64, digest string) error
 }
 
 // BlobStore provides read and write access to blob storage.