Archive a repo

Archive the repo: it stays readable and is excluded from a client's own default discovery by convention rather than by predicate — every read here still returns it, so a caller who wants archived rows gone filters repo_status.

Archiving keeps the repo readable and keeps its remote taken: re-registering the same source_uri while an archive holds it is a 409. That is deliberate — only a DELETE releases the remote — and it works because the archived row is readable, so the conflict names something the caller can inspect.

Idempotent: archiving an archived repo is 200 with changed: false, because that is what a retrying client does and "it is archived" is the honest answer to both calls.

Authorized by delete on the repo's workspace — an archive is a removal from a client's point of view, so it takes the removal receipt and runs the same guard a DELETE does.