Pull-through cache cho container registry

Node pull image → cache miss fetch từ upstream → cache hit phục vụ local, ghim theo digest