OCI distribution-spec conformance: Content-Length, digest validation, upload error codes

Running this registry against the OCI distribution-spec conformance suite (sha256 path) surfaced a few small, independent gaps. I'd like to contribute a focused fix for each as its own self-contained PR, tracked here for the big picture. Each is minimal, ships with tests, and passes `pnpm test` on its branch.

- Preserve Content-Length on blob & manifest GET/HEAD. A client sending `Accept-Encoding: gzip` currently causes the response to switch to chunked transfer-encoding, dropping the `Content-Length` the spec requires. (Only visible at the real wire layer — e.g. Go `net/http` clients and the conformance suite.) → #136
- Reject a by-digest manifest PUT whose content does not match the referenced digest — return 400 `DIGEST_INVALID` instead of storing it under the wrong key. → #137
- Return proper 4xx for upload errors instead of 500 — a wrong client digest on the finalizing PUT becomes 400 `DIGEST_INVALID`; zero-byte/empty blobs and a final chunk carried by the finalizing PUT are handled. → #138
- Fix mounted-blob HEAD to report the source blob's digest/size. This builds on the approach in #121 and corrects a defect in it (the checksum-mismatch test compares a raw `ArrayBuffer` to a hex string, so it never compiles and would misroute every digest-addressed blob). → #139 (credits #121)

And one related cleanliness item (not a conformance gap, but on the same content-negotiation strings):

- Single-source the manifest media-type constants. `manifestTypes` in `src/registry/http.ts` re-types literals that named constants elsewhere already hold (and one type — the OCI image manifest — has no constant at all), so the same content-negotiation string lives in two places and an edit could silently diverge one copy from the spec. A pure, behavior-preserving refactor that builds the list from named constants. → #140

Scope note: SHA-512 is intentionally out of scope (an optional algorithm in the spec); these target the sha256 path. Happy to split, squash, or reorder any of these to whatever is easiest to review.

In case it's handy: each PR applies to `main` on its own, and they barely interact — the only shared spots are `test/index.test.ts` (each adds its own tests) and the blob-HEAD handler in `src/router.ts` (touched by the Content-Length and mounted-blob changes).

Use the linked child issues #136–#140 as the actual work items. Start with the named handlers in src/router.ts, manifestTypes in src/registry/http.ts, and the relevant cases in test/index.test.ts; run pnpm test and confirm each selected conformance gap or refactor is covered by its own passing tests.

Written by the indexing model from the issue text.