Add ranges, listing pagination, MD5 ETags and metadata support

[stut]

Summary

Broadens S3 API compatibility beyond the copy/batch-delete operations in #1. Stacked on that branch — merge #1 first and this diff collapses to a single commit.

• Range GET — single byte ranges (bytes=a-b, bytes=a-, bytes=-suffix) with 206 + Content-Range, 416 InvalidRange when unsatisfiable, and Accept-Ranges: bytes advertised. Malformed/multi-range headers fall back to a full 200 per RFC 9110.
• Conditional requests — If-None-Match and If-Modified-Since on GET/HEAD return 304.
• ListObjectsV2 + real pagination — list-type=2 with KeyCount, opaque continuation tokens and start-after; v1 gains marker/NextMarker. Listings are now in lexicographic key order and IsTruncated is set correctly — previously it was hard-coded false, so any bucket over max-keys silently looked complete (this would have bitten registry garbage-collect on a grown bucket). Also fixes a walk bug where a non-matching file could SkipDir the rest of its directory and drop matching keys.
• MD5 ETags everywhere — PutObject, CopyObject and multipart completion persist the content MD5 (multipart: md5-of-md5s-N) in a JSON sidecar under .metadata/, so PUT responses, GET/HEAD and listings all agree. Objects created before this change keep the mtime-based fallback. Sync tools that compare ETag to MD5 (rclone, s3cmd) now behave.
• Content-Type and x-amz-meta-* — round-trip through PUT, multipart upload and server-side copy, honouring x-amz-metadata-directive: REPLACE.
• GetBucketLocation and subresource handling — ?location and ?versioning/?acl stubs; the AWS error codes clients expect for absent ?lifecycle/?cors/?policy/?tagging/?encryption/?object-lock config. Subresource PUT/DELETE are accepted as no-ops — previously PUT /bucket?acl hit CreateBucket, DELETE /bucket?lifecycle deleted the bucket, and PUT /key?acl overwrote the object with the ACL body.
• ListBuckets no longer exposes the internal .multipart/.metadata directories as buckets.

Out of scope (per discussion): aws-chunked streaming uploads, POST form uploads, presigned-URL semantics.

Testing

• New pkg/s3/compat_test.go: range boundaries (first/last byte, suffix, open-ended, clamped, unsatisfiable, malformed), conditional 304s, ETag agreement across PUT/GET/HEAD/List, metadata round-trips (plain, multipart, copy, REPLACE directive), v1 marker and v2 continuation-token pagination walks, delimiter rollup with pagination, subresource stubs and error codes, bucket-survives-DELETE ?lifecycle, object-survives-PUT ?acl
• go test -race ./... green, golangci-lint clean
• End-to-end: registry:2 push/pull round-trip (40MB multipart layer + small layers), zero 405/500/panic; live wire-format checks of ?location, V2 pagination tokens, ranged reads and ?versioning