[m-ferrero]

Problem

There is no way to serve a fully public, read-only registry: every request requires credentials, even pulls. Closes #116.

Solution

Add an opt-in READONLY_ANONYMOUS flag (default off). When it is "true" and a request carries no Authorization header, the request is treated as holding only the pull capability, so GET/HEAD (manifests, blobs, referrers, tag listings) succeed without credentials. Write methods (POST/PUT/PATCH/DELETE) still require an authenticated push credential — an anonymous write is rejected with the usual WWW-Authenticate challenge. A request that does present an Authorization header always takes the normal credential path.

The flag defaults off, so existing deployments are unchanged.

Tests / docs

Adds tests covering anonymous GET/HEAD success and anonymous-write rejection, the example wrangler configs, and a README section.