Cache NAR management (list/show/delete/stats) — fixes #260

[DerDennisOP]

Summary

• Adds /api/v1/caches/{cache}/nars list / show / stats / available (optional-auth) and DELETE (owner-only).
• Ref-counted delete: when other caches still hold the path, only this cache's signature is removed; otherwise the underlying blob is GC'd asynchronously and derivation_output.is_cached is flipped to false.
• New CLI subcommand group gradient cache nar list|show|delete|stats.
• New frontend NAR management page at /caches/{name}/nars with filters, sort, stats card, and confirm-before-delete.
• Per-(cache, path) fetch stats on cached_path_signature (last_fetched_at, fetch_count) plus two supporting indexes; wired into the existing NAR fetch hot path.
• New audit event cache.nar.delete with ref_counted_others payload.

Closes #260. Upload from local store is tracked separately in #261.

Notable design choices

• Read endpoints sit under optional_api so anonymous browsing of public caches keeps working; private caches return 404 to non-owners (matches get_cache and load_cache, avoids leaking cache names).
• Delete pipeline: sync DB transaction handles signature drop, per-cache derivation pin removal, ref-count check, and (when last cache) is_cached flip + cached_path drop. Blob deletion is fire-and-forget via state.shutdown.spawn, mirroring the existing cleanup_nars_for_orgs pattern after whole-cache deletion.
• List endpoint resolves matching cached_path IDs before paginating the signature rows so total honours filters and pages stay consistent.

Test plan

• CI green
• Migration applies on a populated DB
• Manual: push the same path to two caches, delete from one — second still serves; delete from the second — blob gone from nar_storage
• Manual: NARs button on cache-detail navigates to the new page; filters + sort behave; per-row delete prompts and updates the table

Known limitations

• Persistence-asserting tests are #[ignore]'d (the existing test harness uses SeaORM MockDatabase; real-DB verification is CI's job).
• Substring package search is unindexed by design — bounded by the cache scope; pg_trgm is left for a future PR if hot.