Implement HTTP ingestion and retention lifecycle

.env.example

@@ -14,3 +14,20 @@ ARTIFACTSTORE_STORAGE_LOCAL_ROOT=./var/storage
 
 # Python logging level: DEBUG | INFO | WARNING | ERROR
 ARTIFACTSTORE_LOG_LEVEL=INFO
+
+# Shared-secret bearer tokens for the HTTP API. Comma- or newline-separated.
+# Protected endpoints return 401 until at least one token is configured.
+ARTIFACTSTORE_AUTH_TOKENS=dev-token
+
+# Read endpoints are authenticated by default. Set true only for local demos.
+ARTIFACTSTORE_ANON_READ=false
+
+# Defaults used by `artifactstore push` and `artifactstore manifest`.
+ARTIFACTSTORE_API_URL=http://127.0.0.1:8000
+ARTIFACTSTORE_API_TOKEN=dev-token
+
+# Optional TOML file overriding retention class default durations.
+ARTIFACTSTORE_RETENTION_CONFIG_PATH=
+
+# Default interval for external schedulers that run `artifactstore retention sweep`.
+ARTIFACTSTORE_RETENTION_SWEEP_INTERVAL_SECONDS=3600