feat(lfs): Git LFS batch API + basic transfer — content-addressed disk store #5512

Scorecard move #3 of the greenlit block (agent-built, coordinator-rebased onto main)

Full LFS "basic" transfer server: POST .../info/lfs/objects/batch (spec-shaped responses for all four existing/missing × download/upload cases, per-object 404/422 errors, over-cap pre-rejection so clients fail fast instead of streaming 512 MiB into a 413), streamed PUT/GET object endpoints with incremental SHA-256 verification, verify, and spec-shaped empty lock responses so git lfs push doesn't choke.

Storage: content-addressed under ${GIT_REPOS_PATH}/.lfs/ (rides the git-repos volume) — temp-file → hash-verify → atomic rename; concurrent duplicate uploads both succeed; zero residue on any rejection. No DB schema changes. Max size via LFS_MAX_OBJECT_BYTES (default 512 MiB).

Auth mirrors the git Smart HTTP gate exactly: read for download/verify, write for upload, anonymous public-repo reads work, 401+Basic challenge / privacy-preserving 404 / 403 — with LFS-media-type JSON error bodies (git-lfs surfaces message; plain text it doesn't). Action hrefs honor X-Forwarded-Proto/Host for the proxy.

28/28 tests (store roundtrip, hash/size/cap rejection with residue assertions, concurrent duplicates, batch shapes, gate paths); typecheck clean on current main.

🤖 Generated with Claude Code