Add configurable PyPI download mode (redirect vs proxy)

Adds ORCHARD_PYPI_DOWNLOAD_MODE setting (default: "redirect"):
- "redirect": Redirect pip to S3 presigned URL - reduces pod bandwidth
- "proxy": Stream through Orchard pod - for environments where clients can't reach S3

In redirect mode, Orchard only handles metadata requests and upstream fetches.
All file transfers go directly from S3 to the client.

backend/app/config.py

@@ -51,6 +51,7 @@ class Settings(BaseSettings):
     presigned_url_expiry: int = (
         3600  # Presigned URL expiry in seconds (default: 1 hour)
     )
+    pypi_download_mode: str = "redirect"  # "redirect" (to S3) or "proxy" (stream through Orchard)
 
     # Logging settings
     log_level: str = "INFO"  # DEBUG, INFO, WARNING, ERROR, CRITICAL