Serve Front dist zips from Satis

[edalzell]

Summary

• Sites were downloading dist.tar.gz from a private GitHub release URL. After Front moved behind Satis, that 401s because site Composer auth is pkgs.trns.fm, not GitHub.
• Point extra.download-dist at https://pkgs.trns.fm/assets/front/{$version}/dist.tar.gz (sibling of Satis’s own public/dist archives).

Server (not in this PR)

• Forge deploy, after satis build, should gh release download dist.tar.gz into /home/forge/pkgs.trns.fm/public/assets/front/<tag>/.
• Auth: gh reads ~/.config/gh/hosts.yml (PAT with contents:read on every Satis GitHub repo). Deploy keys cannot download release assets.
• Confirm Forge basic auth covers /assets/ (cat /etc/nginx/forge-conf/3287057/server/* — not the site home). If the security rule is only /dist/, extend it or the zip is public.

Test plan

• Latest Front GitHub release still has a dist.tar.gz asset
• After a Satis deploy, https://pkgs.trns.fm/assets/front/v3.2.0/dist.tar.gz is 401 without creds, 200 with Satis http-basic
• composer update transformstudios/front on a site populates vendor/transformstudios/front/dist/