fix(oci): support single-post blob upload to fix BuildKit config blob unknown

[The127]

Summary

• Docker 23+ BuildKit uses single-post blob upload (POST /v2/.../blobs/uploads/?digest=sha256:... with the blob body inline) for small blobs such as the image config. The registry was returning 400 UNSUPPORTED, which containerd silently treated as a skip, leaving the config blob off repository_blobs and causing unknown blob on pull.
• Layers were unaffected because they are large and always go through the normal PATCH+PUT chunked path.
• Workaround was DOCKER_BUILDKIT=0.

Changes

• BlobsUploadStart: when ?digest= is present, upload the full body via UploadCompleteBlob, create the repository_blobs entry, and return 201 Created — matching OCI Distribution Spec single-post upload semantics.
• repository_blobs insert: add ON CONFLICT (repository_id, blob_id) DO NOTHING so concurrent or retry uploads of the same blob don't fail the transaction.
• BlobsDownload: fix two missing return statements after error handling that caused nil-pointer panics.
• UploadCompleteBlob: track byte count via countReader and expose as Size on the response so the blob DB record gets the correct size.

Test plan

• docker build with default BuildKit (Docker 23+) and push to registry — pull should succeed
• Confirm DOCKER_BUILDKIT=0 path still works
• Push same image twice (re-push) — no unique constraint errors