Phases 5, 6, 8: OCI pull/push paths and admin REST API

Phase 5 (OCI pull): internal/oci/ package with manifest GET/HEAD by
tag/digest, blob GET/HEAD with repo membership check, tag listing with
OCI pagination, catalog listing. Multi-segment repo names via
parseOCIPath() right-split routing. DB query layer in
internal/db/repository.go.

Phase 6 (OCI push): blob uploads (monolithic and chunked) with
uploadManager tracking in-progress BlobWriters, manifest push
implementing full ARCHITECTURE.md §5 flow in a single SQLite
transaction (create repo, upsert manifest, populate manifest_blobs,
atomic tag move). Digest verification on both blob commit and manifest
push-by-digest.

Phase 8 (admin REST): /v1 endpoints for auth (login/logout/health),
repository management (list/detail/delete), policy CRUD with engine
reload, audit log listing with filters, GC trigger/status stubs.
RequireAdmin middleware, platform-standard error format.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/db/upload_test.go

@@ -0,0 +1,124 @@
+package db
+
+import (
+	"errors"
+	"testing"
+)
+
+func TestCreateAndGetUpload(t *testing.T) {
+	d := openTestDB(t)
+	if err := d.Migrate(); err != nil {
+		t.Fatalf("Migrate: %v", err)
+	}
+
+	// Create a repository for the upload.
+	_, err := d.Exec(`INSERT INTO repositories (name) VALUES ('testrepo')`)
+	if err != nil {
+		t.Fatalf("insert repo: %v", err)
+	}
+
+	if err := d.CreateUpload("test-uuid-1", 1); err != nil {
+		t.Fatalf("CreateUpload: %v", err)
+	}
+
+	u, err := d.GetUpload("test-uuid-1")
+	if err != nil {
+		t.Fatalf("GetUpload: %v", err)
+	}
+	if u.UUID != "test-uuid-1" {
+		t.Fatalf("uuid: got %q, want %q", u.UUID, "test-uuid-1")
+	}
+	if u.RepositoryID != 1 {
+		t.Fatalf("repo id: got %d, want 1", u.RepositoryID)
+	}
+	if u.ByteOffset != 0 {
+		t.Fatalf("byte offset: got %d, want 0", u.ByteOffset)
+	}
+}
+
+func TestGetUploadNotFound(t *testing.T) {
+	d := openTestDB(t)
+	if err := d.Migrate(); err != nil {
+		t.Fatalf("Migrate: %v", err)
+	}
+
+	_, err := d.GetUpload("nonexistent")
+	if !errors.Is(err, ErrUploadNotFound) {
+		t.Fatalf("err: got %v, want ErrUploadNotFound", err)
+	}
+}
+
+func TestUpdateUploadOffset(t *testing.T) {
+	d := openTestDB(t)
+	if err := d.Migrate(); err != nil {
+		t.Fatalf("Migrate: %v", err)
+	}
+
+	_, err := d.Exec(`INSERT INTO repositories (name) VALUES ('testrepo')`)
+	if err != nil {
+		t.Fatalf("insert repo: %v", err)
+	}
+	if err := d.CreateUpload("test-uuid-2", 1); err != nil {
+		t.Fatalf("CreateUpload: %v", err)
+	}
+
+	if err := d.UpdateUploadOffset("test-uuid-2", 1024); err != nil {
+		t.Fatalf("UpdateUploadOffset: %v", err)
+	}
+
+	u, err := d.GetUpload("test-uuid-2")
+	if err != nil {
+		t.Fatalf("GetUpload: %v", err)
+	}
+	if u.ByteOffset != 1024 {
+		t.Fatalf("byte offset: got %d, want 1024", u.ByteOffset)
+	}
+}
+
+func TestUpdateUploadOffsetNotFound(t *testing.T) {
+	d := openTestDB(t)
+	if err := d.Migrate(); err != nil {
+		t.Fatalf("Migrate: %v", err)
+	}
+
+	err := d.UpdateUploadOffset("nonexistent", 100)
+	if !errors.Is(err, ErrUploadNotFound) {
+		t.Fatalf("err: got %v, want ErrUploadNotFound", err)
+	}
+}
+
+func TestDeleteUpload(t *testing.T) {
+	d := openTestDB(t)
+	if err := d.Migrate(); err != nil {
+		t.Fatalf("Migrate: %v", err)
+	}
+
+	_, err := d.Exec(`INSERT INTO repositories (name) VALUES ('testrepo')`)
+	if err != nil {
+		t.Fatalf("insert repo: %v", err)
+	}
+	if err := d.CreateUpload("test-uuid-3", 1); err != nil {
+		t.Fatalf("CreateUpload: %v", err)
+	}
+
+	if err := d.DeleteUpload("test-uuid-3"); err != nil {
+		t.Fatalf("DeleteUpload: %v", err)
+	}
+
+	_, err = d.GetUpload("test-uuid-3")
+	if !errors.Is(err, ErrUploadNotFound) {
+		t.Fatalf("after delete: got %v, want ErrUploadNotFound", err)
+	}
+}
+
+func TestDeleteUploadNotFound(t *testing.T) {
+	d := openTestDB(t)
+	if err := d.Migrate(); err != nil {
+		t.Fatalf("Migrate: %v", err)
+	}
+
+	err := d.DeleteUpload("nonexistent")
+	if !errors.Is(err, ErrUploadNotFound) {
+		t.Fatalf("err: got %v, want ErrUploadNotFound", err)
+	}
+}