fix: proxy dedup, multi-registry GC, TOCTOU and credential hygiene (#83)

- Deduplicate proxy_fetch/proxy_fetch_text into generic proxy_fetch_core
  with response extractor closure (removes ~50 lines of copy-paste)
- GC now scans all registry prefixes, not just docker/
- Add tracing::warn to fire-and-forget cache writes in docker proxy
- Mark S3 credentials as skip_serializing to prevent accidental leaks
- Remove TOCTOU race in LocalStorage get/delete (redundant exists check)

nora-registry/src/gc.rs

@@ -72,10 +72,15 @@ pub async fn run_gc(storage: &Storage, dry_run: bool) -> GcResult {
 
 async fn collect_all_blobs(storage: &Storage) -> Vec<String> {
     let mut blobs = Vec::new();
-    let docker_blobs = storage.list("docker/").await;
-    for key in docker_blobs {
-        if key.contains("/blobs/") {
-            blobs.push(key);
+    // Collect blobs from all registry types, not just Docker
+    for prefix in &[
+        "docker/", "maven/", "npm/", "cargo/", "pypi/", "raw/", "go/",
+    ] {
+        let keys = storage.list(prefix).await;
+        for key in keys {
+            if key.contains("/blobs/") || key.contains("/tarballs/") {
+                blobs.push(key);
+            }
         }
     }
     blobs