feat(docker): Add Docker registry support

[Mindgamesnl]

Adds docker as a fourth repository format: push and pull with any Docker client, browse
layers and platforms in the UI, proxy another registry, reclaim storage, and migrate
docker repositories from Nexus.

The registry API is mounted at /v2 on the host root, because a Docker client builds
its own URLs from the image reference and cannot be pointed at a path prefix. The
repository name is the first segment of the image instead, so repo.example.com/images/team/api:1.4
is the team/api image of the images repository, and one host serves every repository
on one port with no connector. A default docker repository can be set so a bare
reference works too.

A tag is a component and its manifest is an asset, so version listing, search, traffic
and storage accounting all come for free. What needed new tables is the part the asset
model cannot express: a layer is shared between tags, so per-version size and safe
deletion need an explicit manifest-to-blob relation. That relation is also what lets the
UI say how much of a tag is unique to it, and what makes the storage sweep safe.

Docker repositories default to a mixed policy. Their tags carry arbitrary suffixes,
and a real one like 0.1.9-swaggerui-staging is neither a release nor a prerelease by
any rule worth writing.

Verified against real container images throughout: docker save output pushed and pulled
byte for byte, a buildkit multi-platform index with its attestation child, and Docker Hub
proxied for real. The release image is now mirrored to our own instance with
imagetools, which preserves digests, so both registries serve identical bytes.

docs/docker.md covers using it, and docs/migrating.md gains the docker section.

Note: e85af45 ("Make link clickable and point to github") was already on this branch and
is unrelated to docker. Say the word if you would rather it went separately.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}