Complete WP-0010: HTTP remote federation with cache

Extend federation manifest schema for url sources with auth and TTL metadata.
Fetch remote capability indexes over HTTP(S), cache under
registry/federation/cache/, and fall back to stale cache on fetch failure.
Add --refresh flag, seven federation tests, and updated federation docs.

registry/federation/sources.yaml

@@ -32,4 +32,13 @@ sources:
     enabled: false
     required: false
     domain: helix_forge
-    description: Identity canon research capabilities
+    description: Identity canon research capabilities
+
+  # Remote index example — enable when a repo publishes a raw capabilities.yaml URL
+  - repo: example-remote
+    url: https://example.com/registry/indexes/capabilities.yaml
+    enabled: false
+    required: false
+    domain: helix_forge
+    cache_ttl_seconds: 86400
+    description: Illustrative HTTP federation source (disabled)