feat!: support OME-Zarr 0.5 and Zarr v3

[uermel]

Summary

• Upgrade the server to the copick 2.0 alpha and Zarr v3 asynchronous store API.
• Preserve the Zarr proxy URLs while adding correct HEAD and single-range GET behavior.
• Validate OME-Zarr 0.4/Zarr v2 and OME-Zarr 0.5/Zarr v3 behavior with real reader fixtures, including sharded, floating-point, corrupt, and invalid-metadata cases.
• Add Python and Node behavior matrices plus production-container smoke coverage.
• Add linked server/client alpha prereleases, immutable image tags, exact-version deployment controls, rollback guidance, and compatibility documentation.

Validation

• Server behavior: 29 tests pass locally; CI covers Python 3.11–3.14.
• Client behavior: 6 tests pass using actual Idetik/Zarrita reads and bounded sharded range traffic; CI covers Node 20.19 and 22.
• TypeScript type checking and the production client build pass.
• Python and JavaScript lint and format checks pass.
• Both production images build and pass their smoke tests.
• Production Compose smoke testing passes through Nginx for health, API, SPA, HEAD, and suffix-range requests.
• All workflow files pass action-validator.

Scope

Per the migration decision, this implementation focuses on observable behavior. It does not add structural guards, AST-parsing tests, dependency-declaration tests, or published-artifact tests.

The external S3, SSH, and ML Croissant release-environment gates, first alpha publication, and stable cutover remain follow-up release gates. Required-check rulesets will be tightened only after the new contexts have reported successfully on both protected branches.

Closes #14

Refs #13, #15, #16, #17, #18