fix pull stats tracking

pkg/appview/db/migrations/0007_add_artifact_type.yaml

···
+description: Add artifact_type column to manifests table for Helm chart support
+query: |
+  -- Add artifact_type column to track manifest types (container-image, helm-chart, unknown)
+  -- Default to container-image for existing manifests
+  ALTER TABLE manifests ADD COLUMN artifact_type TEXT NOT NULL DEFAULT 'container-image';
+
+  -- Add index for filtering by artifact type
+  CREATE INDEX IF NOT EXISTS idx_manifests_artifact_type ON manifests(artifact_type);

pkg/hold/oci/xrpc.go

···
 		return
 	}
 
-	// Verify user DID matches token
-	if req.UserDID != validatedUser.DID {
-		RespondError(w, http.StatusForbidden, "user DID mismatch")
-		return
-	}
-
 	// Default operation to "push" for backward compatibility
 	operation := req.Operation
 	if operation == "" {
···
 	// Validate operation
 	if operation != "push" && operation != "pull" {
 		RespondError(w, http.StatusBadRequest, fmt.Sprintf("invalid operation: %s (must be 'push' or 'pull')", operation))
+		return
+	}
+
+	// Verify user DID matches token - only for pushes
+	// For pulls: userDID is the repo owner (for stats), but the token belongs to the puller
+	// This allows anyone to pull from a public repo and have stats tracked under the owner
+	if operation == "push" && req.UserDID != validatedUser.DID {
+		RespondError(w, http.StatusForbidden, "user DID mismatch")
 		return
 	}