Adds ORCHARD_PYPI_DOWNLOAD_MODE setting (default: "redirect"):
- "redirect": Redirect pip to S3 presigned URL - reduces pod bandwidth
- "proxy": Stream through Orchard pod - for environments where clients can't reach S3
In redirect mode, Orchard only handles metadata requests and upstream fetches.
All file transfers go directly from S3 to the client.