Add structured error logging to OCI handlers

Every 500 response in the OCI package silently discarded the actual
error, making production debugging impossible. Add slog.Error before
each 500 response with the error and relevant context (repo, digest,
tag, uuid). Add slog.Info for state-mutating successes (manifest push,
blob upload complete, deletions).

Logger is injected into the OCI Handler via constructor, falling back
to slog.Default() if nil.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/oci/delete.go

@@ -30,6 +30,7 @@ func (h *Handler) handleManifestDelete(w http.ResponseWriter, r *http.Request, r
 				fmt.Sprintf("repository %q not found", repo))
 			return
 		}
+		h.log.Error("manifest delete: lookup repository", "error", err, "repo", repo)
 		writeOCIError(w, "UNKNOWN", http.StatusInternalServerError, "internal error")
 		return
 	}
@@ -40,12 +41,15 @@ func (h *Handler) handleManifestDelete(w http.ResponseWriter, r *http.Request, r
 				fmt.Sprintf("manifest %q not found", reference))
 			return
 		}
+		h.log.Error("manifest delete: delete from database", "error", err, "repo", repo, "digest", reference)
 		writeOCIError(w, "UNKNOWN", http.StatusInternalServerError, "internal error")
 		return
 	}
 
 	h.audit(r, "manifest_deleted", repo, reference)
 
+	h.log.Info("manifest deleted", "repo", repo, "digest", reference)
+
 	w.WriteHeader(http.StatusAccepted)
 }
 
@@ -64,6 +68,7 @@ func (h *Handler) handleBlobDelete(w http.ResponseWriter, r *http.Request, repo,
 				fmt.Sprintf("repository %q not found", repo))
 			return
 		}
+		h.log.Error("blob delete: lookup repository", "error", err, "repo", repo)
 		writeOCIError(w, "UNKNOWN", http.StatusInternalServerError, "internal error")
 		return
 	}
@@ -74,11 +79,14 @@ func (h *Handler) handleBlobDelete(w http.ResponseWriter, r *http.Request, repo,
 				fmt.Sprintf("blob %q not found in repository", digest))
 			return
 		}
+		h.log.Error("blob delete: delete from database", "error", err, "repo", repo, "digest", digest)
 		writeOCIError(w, "UNKNOWN", http.StatusInternalServerError, "internal error")
 		return
 	}
 
 	h.audit(r, "blob_deleted", repo, digest)
 
+	h.log.Info("blob deleted", "repo", repo, "digest", digest)
+
 	w.WriteHeader(http.StatusAccepted)
 }