Summary

• Implements GET /metadata/changes.json so mirrors, indexers, and other tools can track incremental metadata updates without crawling and reprocessing full repository metadata
• New metadata_changes SQLite table records which packages changed during each build
• ?since=<timestamp> returns the latest action per package name within the requested window
• Returns resync action when since is older than 24h retention window
• Missing/invalid since returns error + bootstrap timestamp
• metadata-changes-url advertised in packages.json (absolute URL pointing to app server)
• Skips delete detection for partial builds to avoid false deletes

Ref https://packagist.org/apidoc#track-package-updates

Closes #23

Test plan

• go test ./... passes (6 new handler tests + smoke test assertion)
• make dev — verify packages.json includes metadata-changes-url
• curl /metadata/changes.json returns {error, timestamp}
• curl /metadata/changes.json?since=0 returns resync action
• After a build, curl /metadata/changes.json?since=<timestamp> returns changed packages

🤖 Generated with Claude Code