Fix nested dependency depth tracking in PyPI cache worker

When the cache worker downloaded a package through the proxy, dependencies
were always queued with depth=0 instead of depth+1. This meant depth limits
weren't properly enforced for nested dependencies.

Changes:
- Add cache-depth query parameter to pypi_download_file endpoint
- Worker now passes its current depth when fetching packages
- Dependencies are queued at cache_depth+1 instead of hardcoded 0
- Add tests for depth tracking behavior

backend/app/pypi_proxy.py

@@ -516,6 +516,7 @@ async def pypi_download_file(
     package_name: str,
     filename: str,
     upstream: Optional[str] = None,
+    cache_depth: int = Query(default=0, ge=0, le=100, alias="cache-depth"),
     db: Session = Depends(get_db),
     storage: S3Storage = Depends(get_storage),
 ):
@@ -526,6 +527,7 @@ async def pypi_download_file(
         package_name: The package name
         filename: The filename to download
         upstream: URL-encoded upstream URL to fetch from
+        cache_depth: Current cache recursion depth (used by cache worker for nested deps)
     """
     if not upstream:
         raise HTTPException(
@@ -772,17 +774,19 @@ async def pypi_download_file(
                     db.add(dep)
 
         # Proactively cache dependencies via task queue
+        # Dependencies are queued at cache_depth + 1 to track recursion
         if unique_deps:
+            next_depth = cache_depth + 1
             for dep_name, dep_version in unique_deps:
                 enqueue_cache_task(
                     db,
                     package_name=dep_name,
                     version_constraint=dep_version,
                     parent_task_id=None,  # Top-level, triggered by user download
-                    depth=0,
+                    depth=next_depth,
                     triggered_by_artifact=sha256,
                 )
-            logger.info(f"PyPI proxy: queued {len(unique_deps)} dependencies for caching")
+            logger.info(f"PyPI proxy: queued {len(unique_deps)} dependencies for caching (depth={next_depth})")
 
         db.commit()