Complete WP-0010: HTTP remote federation with cache

Extend federation manifest schema for url sources with auth and TTL metadata.
Fetch remote capability indexes over HTTP(S), cache under
registry/federation/cache/, and fall back to stale cache on fetch failure.
Add --refresh flag, seven federation tests, and updated federation docs.

SCOPE.md

@@ -55,6 +55,7 @@ and agents can:
 - **Browse a searchable catalog** at `docs/catalog/search.html` (client-side
   filter over `registry.json`)
 - **Compose federated indexes** with `reuse-surface federation compose`
+  (local paths and remote HTTP URLs with cache)
 - **Generate relation graphs** with `reuse-surface graph`
 - **Explore relations interactively** at `docs/graph/index.html`
 - **Avoid duplicates** by querying the index and checking overlaps before adding entries
@@ -65,7 +66,7 @@ the index, and CLI automation.
 
 ## What Is Not Possible Yet
 
-- Network-based federation or cross-org index sync
+- Live cross-org index sync (polling/webhooks) beyond on-demand HTTP fetch
 - Packaged releases beyond local `pip install -e .` and Gitea CI validation
 
 See `tools/README.md` for command reference.
@@ -84,7 +85,8 @@ See `tools/README.md` for command reference.
   `docs/graph/index.html`.
 - Searchable catalog: `docs/catalog/search.html`.
 - Test suite: `tests/` (pytest).
-- Finished workplans: `REUSE-WP-0001` through `REUSE-WP-0009`.
+- Remote federation: HTTP URL sources with cache in `registry/federation/cache/`.
+- Finished workplans: `REUSE-WP-0001` through `REUSE-WP-0010`.
 - **Self-assessed vector:** `D5 / A3 / C4 / R3` (see gap analysis).
 
 ## Repository Layout