feat: replica registration protocol (Phase 2 v1)

[kevincodex1]

Phase 2 of the network-resilience plan: any node can register itself as a replica of someone else's repo, and the origin exposes the replica list publicly as a "your repo is mirrored by N nodes" trust signal.

What ships

• New repo_replicas table keyed by (repo_id, replica_did) with replica URL and registration timestamp. UNIQUE on (repo_id, replica_did); duplicate registrations update the URL.
• API on origin:
  PUT /api/v1/repos/:owner/:repo/replicas (auth) register
  DELETE /api/v1/repos/:owner/:repo/replicas (auth) unregister
  GET /api/v1/repos/:owner/:repo/replicas (public) list
  Origin rejects self-registration and validates the replica URL (http(s),
  no whitespace/control chars, length-bounded).
• CLI:
  gl repo replica-register / --url
  gl repo replica-unregister /
  gl repo replicas /
• gl repo info now shows "Replicas: N" when the origin supports it.
• Tests: 5 new unit tests for the URL validator. Full node suite at 51 pass,
  full gl suite at 188 pass.

Deferred to Phase 2.5

• Replica auto-pulls the repo on registration (today: operator runs git clone gitlawb://... manually after registering).
• Periodic freshness sync worker driven by the replica list.
• Gossipsub subscription to push ref-update events to replicas live.