Pull through one host.

This endpoint fronts ghcr.io and rewrites the registry auth challenge so the Docker client can stay on ghcr-6u5.pages.dev for both token exchange and image fetch.