snap: full snapd store protocol support (auth bypass, deltas, v1 endpoints, redirects)

Goal: a snapd pointed at pkgproxy via SNAPPY_FORCE_API_URL should work for everything it asks the store, not just the v2 info/find/refresh/assertions/download subset. Note the dashboard.snapcraft.io v2 docs describe the publisher API; the client API is documented at https://api.snapcraft.io/docs/.

Decisions: authenticated requests (Authorization / Snap-Device-Authorization) bypass the cache; deltas are supported (rewritten + cached as content-addressed blobs) but never generated; legacy v1 search/details/metadata are proxied and rewritten too.

Phases:

1. Correctness: cache key / auth bypass, rewrite resources/integrity/sboms/media/deltas, identity Accept-Encoding, never cache 4xx/5xx
2. Passthrough: /api/v1/snaps/auth/*, /v1/{request-id,serial}, POST /v2/cohorts, /v2/repairs
3. Download redirects (/api/v1/snaps/download, resources, media) 3b. Legacy v1 search/details/metadata with download_url rewriting
4. Cacheable catalogue: sections, names, categories
5. (optional) refresh caching
6. Exploratory pass against a real snapd (VM)
7. Keep docs/design.md §11 in sync