feat: nora mirror CLI + systemd + install script

nora mirror:
- Pre-fetch dependencies through NORA proxy cache
- npm: --lockfile (v1/v2/v3) and --packages with --all-versions
- pip: requirements.txt parser
- cargo: Cargo.lock parser
- maven: dependency:list output parser
- Concurrent downloads (--concurrency, default 8)
- Progress bar with indicatif
- Health check before start

dist/:
- nora.service — systemd unit with security hardening
- nora.env.example — environment configuration template
- install.sh — automated install (binary + user + systemd + config)

Tested: 103 tests pass, 0 clippy warnings, cargo audit clean.
Smoke: mirrored 70 npm packages from real lockfile in 5.4s.

dist/nora.service

@@ -0,0 +1,28 @@
+[Unit]
+Description=NORA Artifact Registry
+Documentation=https://getnora.dev
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=nora
+Group=nora
+ExecStart=/usr/local/bin/nora serve
+WorkingDirectory=/etc/nora
+Restart=on-failure
+RestartSec=5
+LimitNOFILE=65535
+
+# Security hardening
+NoNewPrivileges=true
+ProtectSystem=strict
+ProtectHome=true
+ReadWritePaths=/var/lib/nora /var/log/nora
+PrivateTmp=true
+
+# Environment
+EnvironmentFile=-/etc/nora/nora.env
+
+[Install]
+WantedBy=multi-user.target