Authenticate registry/docker pull requests.

In the Depot proxy flow this endpoint is called by nginx auth_request to verify the miner before nginx proxies to Depot's token endpoint; it only needs to return 200 on success (or 401 on failure).

The VM's attested measurement version decides which auth is required:

• version >= registry_mtls_min_version: mTLS. The nginx frontend forwards the client cert as X-Client-Cert; the leaf is verified against the CA registered for the VM. No legacy fallback — a VM this new must use mTLS.
• otherwise (older VM, or unknown IP): legacy Bittensor hotkey/signature/nonce.

Setting registry_mtls_min_version to "0.0.0" forces every attested VM onto mTLS — the kill switch that closes the legacy "any registered miner can pull any private chute" hole once the fleet is fully migrated.

The require_registry_proxy_secret dependency, when REGISTRY_PROXY_SECRET is configured, rejects requests that do not carry X-Registry-Proxy-Auth matching the secret, preventing X-Client-Cert / X-Real-IP spoofing on connections that bypass the registry proxy. The mTLS client cert is extracted (typed) by extract_optional_client_cert.