Add private registry login + registry-aware pull

[kylemclaren]

What

Ship the ability to authenticate to private registries from ContainerUI, and make the pull sheet registry-aware.

Wraps Apple's container registry login|logout|list. Pull from a private registry already worked once you were logged in — this adds the login UI that unlocks it, plus a hint so a private pull doesn't fail cryptically when you're not signed in.

(Registry browse is deliberately out of scope — private registries speak the OCI Distribution API, not Docker Hub's search, so Explore stays Docker-Hub-only.)

Changes

Core

• RegistryService — login (password piped via --password-stdin, never in argv), logout, list (rich JSON), loggedInHosts (from --quiet).
• RegistryLogin — tolerant Decodable (hostname/host/server, username/user), since registry list --format json returns [] today and its keys are unverifiable.
• RegistryHost — normalizes hosts and folds Docker Hub aliases (docker.io, index.docker.io, …) to one key.

App / UI

• System screen: a Registries card — lists logins, log out per row, "Log in" sheet.
• RegistryLoginView — server / username / password (SecureField) / scheme sheet, mirroring CreateVolumeView.
• Pull sheet: a non-blocking InlineBanner — "Not signed in to ghcr.io" with a prefilled Log in action. Docker Hub / public pulls never nag; the hint never gates a pull.

Design notes

• The pull hint's source of truth is --quiet (hostname-only, format-stable), not JSON — so a JSON key rename can't break the safety-critical path. JSON only enriches the management list, and falls back to --quiet rows if it fails to decode.
• loggedInRegistries is Set<String>?: nil = unknown ⇒ hint stays silent (fail safe, never a false nag).
• Password sent as stdin Data with no trailing newline; not a parameter of any argument builder.

Testing

• 115 tests pass (adds registry arg-builder — asserting the password is absent from argv — service, tolerant-decoding, and RegistryHost normalization suites).
• xcodebuild build clean (per repo convention, the test action skips the SwiftUI app target, so the app target was built separately to catch view compile errors).

Runtime QA against a live private registry (actual login/pull) is worth a manual pass before merge.

🤖 Generated with Claude Code

[kylemclaren]

Adversarial review — done, findings fixed

Ran a multi-lens adversarial review (7 finder lenses → each finding refuted by 3 diverse skeptics, majority-confirm to survive → completeness critic). 16 findings raised, 10 survived verification. The material ones are now fixed in cb80252:

Fixed

• JSON keys were wrong (HIGH). The real container registry list --format json emits the host under name/id and dates under creationDate/modificationDate — the guessed hostname/host/server never matched, so list() always threw and the card silently degraded to hostname-only with a blank username. The tests were false-green (invented-key fixtures). Now decodes the real shape (verified against the live CLI) with the old spellings kept as tolerant fallbacks; fixtures/tests use real output.
• Explore's Pull sheet missed .environment(app) (crash risk). PullImageView gained an AppModel dependency and ImagesScreen's sheet was updated, but ExploreScreen's second call site wasn't — Pull-from-Explore could trap. Injected.
• Stale errorMessage in RegistriesSection.reload(). A transient error stuck under a later-healthy list. Cleared at the top of reload; empty-state text suppressed while an error shows.
• Logout used a normalized host. The decode-failure fallback now uses verbatim --quiet hostnames (new loggedInHostsRaw), so logout(server:) sends the exact stored name.

Deferred (by-design or low, with rationale)

• HTTP scheme has no cleartext warning — intentional for localhost/plain registries.
• Docker Hub private repos get no hint — intentional (avoids nagging on every public pull); reviewers largely refuted it.
• reload() issues two registry list calls — user-initiated, not on any polling path.

116 tests pass; app builds clean.