dashboard: packages-service reads the mirror-history artifact (+ endpoint) #160

Part of #157.

Give the CSSC Dashboard backend the ability to read a repo's synchronized history.

Scope (apps/python-app/services/packages-service)

• Add a client capability to fetch and parse <quarantine/<image>>:mirror-history: resolve the mirror-history tag manifest, read its single JSON layer blob (GHCR v2 registry blob fetch, not just the Packages API), and return the parsed entries.
• New endpoint, e.g. GET /packages/{name:path}/history, returning the parsed entries (source tag, source digest, dest tag, syncedAt, run URL). Return an empty history when the tag is absent.
• Add a helper to exclude the reserved mirror-history tag when computing whether an image is actually present in quarantine (consumed by dashboard: Acquisition view surfaces per-repo synchronized history #161).
• Auth: reuse the existing read:packages token; registry reads use the same credentials. Handle the anonymous/public case too. Tests for parse + empty + reserved-tag exclusion.

Depends on: #158 (artifact schema).
Design: docs/architecture/acquire/mirror-history.md (Dashboard integration).