Gradient CLI cache NAR upload

[DerDennisOP]

Split out from #260.

Add a gradient cache upload command (and supporting backend HTTP endpoint) to push local Nix store paths to a Gradient cache the user is authenticated against.

Scope

• Backend: new POST /api/v1/caches/{cache}/nars endpoint accepting NAR bytes + narinfo metadata. Writes cached_path + cached_path_signature rows, signs server-side, stores blob in nar_storage. Authenticated; requires cache-edit (or a more specific cache-write) permission.
• CLI: gradient cache upload <store-path...> — resolves store paths locally (via harmonia LocalNixStore), dumps NAR, computes refs/hashes, POSTs to the backend.
• Shared ingest logic between this path and the existing worker proto NarPush / NarUploaded flow lifted into gradient_core::cache::ingest (or similar) so both stay DRY.
• Docs, OpenAPI, tests.
• We also want a --full-closure option that uploads a full store paths closure

Notes

• Substituter parallel: harmonia exposes PUT /<hash>.narinfo and PUT /nar/<file>.nar.zst. Keep our endpoint shape close to that idiom but JSON-first.
• Signature ref-counting semantics (multiple caches sharing one underlying NAR) must match the deletion semantics introduced in Gradient CLI cache upload / delete option #260.