OCI registry auth fails with remote Docker daemons due to backend credential resolution

[ilopezluna]

Problem

OCI registry credentials are currently resolved in the backend. This differs from Docker Images, where the client resolves credentials and passes them to the daemon.

Backend-side credential resolution fails when using a remote Docker daemon (e.g. Docker Offload), because the remote host has no access to the local config.json. As a result, pulling/pushing to authenticated OCI registries does not work with remote daemons.

Expected behavior

OCI registry credentials should be resolved on the client, consistent with Docker Images, to support remote Docker daemons.

cc: @doringeman