feat: add scoped image sync endpoint

compose.yaml

@@ -4,7 +4,7 @@ services:
   image-hook:
     build:
       context: ./node-hook
-    image: sam-image-hook:1.0.0
+    image: sam-image-hook:1.1.0
     restart: unless-stopped
     user: "${IMAGE_UID:-1000}:${IMAGE_GID:-1000}"
     read_only: true
@@ -20,6 +20,7 @@ services:
       IMAGE_STATE_PATH: /var/lib/image-hook/state.json
       GITEA_WEBHOOK_SECRET_FILE: /run/secrets/gitea_webhook_secret
       IMAGE_ADMIN_SECRET_FILE: /run/secrets/image_admin_secret
+      IMAGE_SYNC_CLIENT_SECRET_FILES: core=/run/secrets/image_sync_core_secret,core2026=/run/secrets/image_sync_core2026_secret
     volumes:
       - type: bind
         source: ${IMAGE_REPOSITORY_PATH:-.}
@@ -28,6 +29,8 @@ services:
     secrets:
       - gitea_webhook_secret
       - image_admin_secret
+      - image_sync_core_secret
+      - image_sync_core2026_secret
     tmpfs:
       - /tmp:size=16m,mode=1777
     cap_drop: [ALL]
@@ -47,7 +50,7 @@ services:
   image-web:
     build:
       context: ./deploy/nginx
-    image: sam-image-web:1.0.0
+    image: sam-image-web:1.1.0
     restart: unless-stopped
     depends_on:
       image-hook:
@@ -88,3 +91,7 @@ secrets:
     file: ${GITEA_WEBHOOK_SECRET_FILE:-./secrets/gitea_webhook_secret}
   image_admin_secret:
     file: ${IMAGE_ADMIN_SECRET_FILE:-./secrets/image_admin_secret}
+  image_sync_core_secret:
+    file: ${IMAGE_SYNC_CORE_SECRET_FILE:-./secrets/image_sync_core_secret}
+  image_sync_core2026_secret:
+    file: ${IMAGE_SYNC_CORE2026_SECRET_FILE:-./secrets/image_sync_core2026_secret}