feat: nora mirror CLI + systemd + install script

nora mirror:
- Pre-fetch dependencies through NORA proxy cache
- npm: --lockfile (v1/v2/v3) and --packages with --all-versions
- pip: requirements.txt parser
- cargo: Cargo.lock parser
- maven: dependency:list output parser
- Concurrent downloads (--concurrency, default 8)
- Progress bar with indicatif
- Health check before start

dist/:
- nora.service — systemd unit with security hardening
- nora.env.example — environment configuration template
- install.sh — automated install (binary + user + systemd + config)

Tested: 103 tests pass, 0 clippy warnings, cargo audit clean.
Smoke: mirrored 70 npm packages from real lockfile in 5.4s.

nora-registry/src/main.rs

@@ -12,6 +12,7 @@ mod gc;
 mod health;
 mod metrics;
 mod migrate;
+mod mirror;
 mod openapi;
 mod rate_limit;
 mod registry;
@@ -82,6 +83,17 @@ enum Commands {
         #[arg(long, default_value = "false")]
         dry_run: bool,
     },
+    /// Pre-fetch dependencies through NORA proxy cache
+    Mirror {
+        #[command(subcommand)]
+        format: mirror::MirrorFormat,
+        /// NORA registry URL
+        #[arg(long, default_value = "http://localhost:4000", global = true)]
+        registry: String,
+        /// Max concurrent downloads
+        #[arg(long, default_value = "8", global = true)]
+        concurrency: usize,
+    },
 }
 
 pub struct AppState {
@@ -164,6 +176,16 @@ async fn main() {
                 println!("\nRun without --dry-run to delete orphaned blobs.");
             }
         }
+        Some(Commands::Mirror {
+            format,
+            registry,
+            concurrency,
+        }) => {
+            if let Err(e) = mirror::run_mirror(format, &registry, concurrency).await {
+                error!("Mirror failed: {}", e);
+                std::process::exit(1);
+            }
+        }
         Some(Commands::Migrate { from, to, dry_run }) => {
             let source = match from.as_str() {
                 "local" => Storage::new_local(&config.storage.path),