feat: add distribution mirroring for Composer packages

[maartenbode]

Summary

• Add downloadArchive() to GitProviderInterface with implementations for GitHub (API zipball), GitLab (API archive), CachedGit (git archive), and GenericGit (unsupported)
• Create CreateDistArchiveAction to orchestrate archive download, SHA-1 hashing, and storage
• Integrate dist creation into SyncRefAction — archives are created after version sync, wrapped in try/catch so failures don't break the sync
• Add DistController endpoint serving archives via file download (local disk) or signed URL redirect (S3)
• Add CleanupDistArchivesAction + RemoveDistArchiveTask + dist:cleanup artisan command for per-package archive retention
• Clean up dist files automatically when a PackageVersion is deleted (model event)
• Include shasum in Composer metadata for integrity verification
• Add config/pricore.php with DIST_ENABLED, DIST_DISK, and DIST_SIGNED_URL_EXPIRY settings
• Add migration for dist_shasum, dist_path on package_versions and dist_keep_last_releases on packages
• Add documentation page at docs/guide/dist-mirroring.md
• Add 9 tests covering archive creation, download endpoint, and metadata output

Closes #27