Add separate version tracking for artifacts

- Add package_versions table with immutable version records
- Support version detection from explicit param, metadata, or filename
- Add version API endpoints (list, get, delete)
- Update ref resolution to check versions before tags
- Add version column to tags table in frontend UI
- Add Create Tag form for pointing tags at existing artifacts
- Update seed data with version records
- Add 16 integration tests for version functionality

CHANGELOG.md

@@ -7,6 +7,18 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 ### Added
+- Added `package_versions` table for immutable version tracking separate from mutable tags
+  - Versions are set at upload time via explicit `version` parameter or auto-detected from filename/metadata
+  - Version detection priority: explicit parameter > package metadata > filename pattern
+  - Versions are immutable once created (unlike tags which can be moved)
+- Added version API endpoints:
+  - `GET /api/v1/project/{project}/{package}/versions` - List all versions for a package
+  - `GET /api/v1/project/{project}/{package}/versions/{version}` - Get specific version details
+  - `DELETE /api/v1/project/{project}/{package}/versions/{version}` - Delete a version (admin only)
+- Added version support to upload endpoint via `version` form parameter
+- Added `version:X.Y.Z` prefix for explicit version resolution in download refs
+- Added version field to tag responses (shows which version the artifact has, if any)
+- Added migration `007_package_versions.sql` with ref_count triggers and data migration from semver tags
 - Added production deployment job triggered by semantic version tags (v1.0.0) with manual approval gate (#63)
 - Added production Helm values file with persistence enabled (20Gi PostgreSQL, 100Gi MinIO) (#63)
 - Added integration tests for production deployment (#63)
@@ -19,6 +31,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - Added internal proxy configuration for npm, pip, helm, and apt (#51)
 
 ### Changed
+- Updated download ref resolution to check versions before tags (version → tag → artifact ID)
 - Deploy jobs now require all security scans to pass before deployment (added test_image, app_deps_scan, cve_scan, cve_sbom_analysis, app_sbom_analysis to dependencies) (#63)
 - Increased deploy job timeout from 5m to 10m (#63)
 - Added `--atomic` flag to Helm deployments for automatic rollback on failure