feat: auth rework - passthrough and environment-based credential modes

[pdylanross]

Summary

Rework upstream authentication to replace hardcoded per-upstream credentials with two new modes:

• Passthrough auth — barnacle forwards client Authorization headers directly to the upstream registry. No credentials stored in barnacle. Upstream 401/WWW-Authenticate responses forwarded back to client. Cached content is revalidated via HEAD with client credentials on every hit.
• Environment auth — barnacle discovers credentials from its runtime environment: static config, dockercfg, k8s ImagePullSecrets, or cloud provider (GCR/ECR/ACR). Clients pull without credentials. Token refresh handled automatically.

Modes are mutually exclusive per-upstream. No client-facing auth enforcement planned — that's a separate concern.

Architecture Docs

• docs/architecture/auth/current.md — documents the current auth implementation
• docs/architecture/auth/next.md — full design for the rework

🤖 Generated with Claude Code