feat: add S3 authentication and fix Docker multi-segment routes

S3 Storage:
- Implement AWS Signature v4 for S3-compatible storage (MinIO, AWS)
- Add s3_access_key, s3_secret_key, s3_region config options
- Support both authenticated and anonymous S3 access
- Add proper URI encoding for S3 canonical requests

Docker Registry:
- Fix routing for multi-segment image names (e.g., library/alpine)
- Add namespace routes for two-segment paths (/v2/{ns}/{name}/...)
- Add debug tracing for upstream proxy operations

Config:
- Add NORA_STORAGE_S3_ACCESS_KEY env var
- Add NORA_STORAGE_S3_SECRET_KEY env var
- Add NORA_STORAGE_S3_REGION env var (default: us-east-1)

nora-registry/src/registry/docker_auth.rs

@@ -77,9 +77,12 @@ impl DockerAuth {
         let scope = format!("repository:{}:pull", name);
         let url = format!("{}?service={}&scope={}", realm, service, scope);
 
+        tracing::debug!(url = %url, "Fetching auth token");
+
         let response = self.client.get(&url).send().await.ok()?;
 
         if !response.status().is_success() {
+            tracing::warn!(status = %response.status(), "Token request failed");
             return None;
         }