feat: support OCI (oci://) Helm chart repositories

[yupanzi]

Summary

Support OCI (oci://) Helm chart repositories. An OCI repository URL points at a single chart path (e.g. oci://registry-1.docker.io/bitnamicharts/nginx); its semver registry tags become the chart's versions, synthesized into a repo.IndexFile so the existing chart list/detail/content endpoints and the frontend work unchanged.

对应 #589：支持添加 oci:// 类型的 Helm 仓库，registry 的 semver tag 即版本列表，浏览 / 安装 / 升级 / 自动升级全链路可用。

• Repository creation accepts oci:// URLs, validating the URL shape (single chart path, no tag/digest) and that the newest tag is a loadable Helm chart
• Versions are listed from registry tags; the newest chart is pulled once to enrich display metadata, adopting its Chart.yaml name for charts mirrored under a different path
• Auto-upgrade resolves the latest version from registry tags, keeping the classic path's version policy and chart-name fail-safe
• Credential-less registries use an explicit anonymous authorizer so the server never falls back to the host's ambient Docker/Helm credential stores
• The archive cache key is computed after OCI tag resolution (a tag-less URL no longer pins a stale "latest"), and cache eviction is scoped so http repositories cannot evict same-host OCI entries
• Version-less chart lookups fall back to the newest entry (prerelease-only charts previously 404'd, for classic repositories too)

Why

Major charts (cert-manager, kata, Bitnami, and most GHCR/GitLab-hosted projects) are moving from classic index.yaml repositories to OCI distribution. Kite's LoadArchive could already download an oci:// chart archive, but OCI repositories could not be registered or browsed — repository creation rejected non-http(s) URLs and all browsing was index.yaml-based.

Related issue

Closes #589

Validation

• go build ./..., go vet, go test ./pkg/helm ./pkg/helmutil, frontend type-check / lint / format all pass
• Live smoke against real registries:
  • oci://registry-1.docker.io/bitnamicharts/nginx: 288 versions listed from tags, latest metadata enriched (description/icon/appVersion), README/values/templates loaded, old versions individually retrievable
  • a GHCR-hosted chart: anonymous token-auth flow verified end to end
• Negative case: registering a non-chart OCI reference (e.g. oci://registry-1.docker.io/library/busybox) is rejected at creation with a clear error
• Install/upgrade/dry-run reuse the existing LoadArchive flow; verified with both tagged and tag-less chart URLs

Checklist

• I reviewed this PR myself before requesting review.
• I understand the changes, including AI-generated parts (if any).
• For new features, a feature request issue is linked.
• I cleaned up AI noise (unnecessary comments, dead code, and unrelated changes).
• This PR is reasonably scoped (or split into smaller PRs).

🤖 Generated with Claude Code