Complete WP-0010: HTTP remote federation with cache

Extend federation manifest schema for url sources with auth and TTL metadata.
Fetch remote capability indexes over HTTP(S), cache under
registry/federation/cache/, and fall back to stale cache on fetch failure.
Add --refresh flag, seven federation tests, and updated federation docs.

schemas/federation.schema.yaml

@@ -2,8 +2,8 @@ $schema: https://json-schema.org/draft/2020-12/schema
 $id: https://reuse-surface.local/schemas/federation.schema.yaml
 title: Registry Federation Manifest
 description: >
-  Schema for registry/federation/sources.yaml. Describes local and sibling
-  capability index sources to compose into a federated index.
+  Schema for registry/federation/sources.yaml. Describes local filesystem and
+  remote HTTP capability index sources to compose into a federated index.
 type: object
 additionalProperties: false
 required: [version, domain, collision_policy, sources]
@@ -25,7 +25,7 @@ $defs:
   source:
     type: object
     additionalProperties: false
-    required: [repo, index, enabled]
+    required: [repo, enabled]
     properties:
       repo:
         type: string
@@ -33,6 +33,12 @@ $defs:
       index:
         type: string
         minLength: 1
+        description: Local path to capabilities.yaml (repo-relative or ~/...)
+      url:
+        type: string
+        format: uri
+        pattern: '^https?://'
+        description: Remote HTTP(S) URL to a capabilities.yaml index
       enabled:
         type: boolean
       required:
@@ -41,4 +47,23 @@ $defs:
       domain:
         type: string
       description:
-        type: string
+        type: string
+      cache_ttl_seconds:
+        type: integer
+        minimum: 0
+        default: 86400
+        description: >
+          Seconds to reuse a cached remote index. 0 always refetches when
+          compose runs (stale cache still used as fallback on fetch failure).
+      auth_env:
+        type: string
+        minLength: 1
+        description: Environment variable holding an Authorization token or full header value
+      auth_header:
+        type: string
+        minLength: 1
+        default: Authorization
+        description: HTTP header name for auth_env value when fetching url sources
+    oneOf:
+      - required: [index]
+      - required: [url]